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New COMPUnST readers using Apple lis 
are advised to read Ms page carefully to avoid 
Jrustration when attempting tofiMow a softkey 
or entering the programs printed in Ais issue. 

What is a softkey, anyway? 

Soflkey is a term which we coined to 
describe a procedure that removes, or at least 
circumvents, any copy-protection on a 
particular disk. Once a softkey procedure has 
been performed, the resulting backup copy can 
usually be celled by the normal copy programs 
(for example: COPYA, on the DOS 3.3 System 
Master disk). 

Commaiids and control keys 

Commands which a reader is required to 
perform are set apart by being in boldface and 
on a separate line. The RETURN key must be 
pressed at the end of every such command 
unless otherwise specified. Control characters 
are preceeded by a small control key. An 
exanq)le of both is: 

6 8P 

Press 6. Next, place one finger on the 8 key 
and then press P. Don't forget to press the 
RETURN key. 

Other special combination keypresses 
include @RESET or c) S RESET. In the 
former, press and hold down the S key then 
press the RESET key. In the latter, press and 
hold down both 3 and C) then press RESET. 

Software recommendations 

The Starter Kit contains most of the 
programs that you need to "Get started". In 
addition, we recommend that you aquire the 
following: 

• Applesoft program editor such as "Global 
Program Line Editor (GPLE)". 

• Assembler such as the "S-C Assembler" 
from S-C software or "Merlin/Big Mac". 

• Bit-copy program such as ' 'Copy n Plus' ' , 
"Locksmitti" or "Essential Data Duplicator". 

• Word-processor (such as AppleWorks). 

• "COPYA", "FID" and "MUFFIN" from 
the DOS 3.3 System Master disk are also 
useful. 

Super lOB and Controllers 

This powerful deprotection utility (in the 
COMPUTIST Starter Kit) and its various 
Controllers are used in many softkey s. (It is 
also on each Super lOB CoUection disk.) 

Reset Into the Monitor 

Sofflc^s occasionally require the user to stq> 
the execution of a copy-protected program and 



directly enter the Apple's system monitor. 
Check the following list to see what hardware 
you will need to obtain this ability. 

Apple n + , //e, compatibles: 1) Place an 
Integer BASIC ROM card in one of the Apple 
slots. 2) Use a non-maskable interrupt (NMI) 
card such as Replay or Wildcard. 

Apple n + , compatibles: 1) Install an F8 
ROM with a modified reset-vector on the 
computer's motherboard as detailed in the 
"Modified ROM's" article (COMPUTIST #6 
or Book Of Softkeys m) or the "Dual 
ROM's" article (COMPUTIST #19). 

Apple lie, lie: Install a modified CD ROM 
on the conq>uter's motherboard. Cutting Edge 
Ent. (Box 43234 Ren Cen Station-HC; Detroit, 
MI 48243) sells a hardware device that will 
give you this important ability but it will void 
an Apple //c warranty. 

Apple //gs: If you have Ifae 2.x ROM, there 
is a hidden classic desk accessory (CDA) that 
allows you to enter the monitor. In order to 
install the new CDA, you should enter the 
monitor before running any protected programs 
(CALL -151) and press "#" RETURN. This 
will turn on two hidden CD As, Memory 
Pecker and Visit Monitor. Thereafter press d 
@ ESC to go to the Desk Accessories menu. 
Select "Visit Monitor" and there you are. Use 
B Y to exit. 

Recommended litorature 

• Af^lell Reference Manual (or lie, He, etc.) 

• DOS 3.3 or ProDOS manual 

• Beneath Apple DOS & Beneath Apple 
ProDOS, by Don Worth and Pieter Lechner, 
from Quality Software 

Typing Applesoft programs 

BASIC programs are printed in a format that 
is designed to minimize errors for readers who 
key in these programs. If you type: 

10HOME:REMCLEAR SCREEN 

The LIST will look like: 

10 HOME : REM CLEAR SCREEN 

...because Af^lesoft inserts spaces into a 
program listing before and after every 
command word or mathematical operator. 
These spaces don't pose a problem except when 
they are inside of quotes or after a DATA 
cotnmand. There are two types of spaces: those 
that have to be keyed and those that don't. 
Spaces that must be typed appear in 
COMPUTIST as delta characters (*). All otfier 
spaces are there for easier reading. 



NOTE: If you want your checksums to 
match, only type spaces within quotes or after 
DATA statements if they are shown as delta 
(*) charactors. SAVE the program at periodic 
intervals using the name given in the article. 

Typing Hexdumps 

Machine language programs are printed in 
COMPUTIST as hexdumps, sometimes also as 
source code. Hexdumps are the shortest and 
easiest format to type in. You must first enter 
the monitor: 

CALL -151 

Key in the hexdump exactly as it appears in 
the magazine, ignoring die four-digit checksum 
($ and four digits) at the end of each line. When 
finished, return to BASIC with: 

3D0G 

BSAVE the program with the filename, 
address and length parameters given in the 
article. 

Typing Source Code 

The source code is printed to help explain 
a program's (^ration. To enter it, you need 
an "Assembler". Most of the source code is 
in S-C Assembler format. If you use a different 
assembler, you will have to translate portions 
of the source code into something your 
assembler will understand. 

Computing checksums 

Checksums are 4-digit hexadecimal numbers 
which tell if you typed a program correcdy and 
help you locate any errors. There are two types 
of checksums: one created by the CHECKBIN 
program (for machine language programs) and 
the other created by the CHECKSOFT 
program (for BASIC programs). Both are on 
the "Starter Kit". 

If your Checksums do not mflteh the 
published checksums then the line where the 
first checksum differs is incorrect. 

CHECKSOFT instructions: Install Checksoft 
(BRUN CHECKSOFT) then LOAD your 
program. Press ft to get the checksums. Correct 
the program line where the checksums differ. 

CHECKBIN instructions: Enter the monitor 
(CALL -151), install Checkbin at some out of 
the way place (BRUN CHECKBIN, A$6000), 
and then LOAD your program. Get the 
checksums by typing the Starting address, a 
period and die Ending address of the file 
foUowed by a @ Y. 
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Correct the lines where the checksums differ. 



Writing to the RDEX editor 

• RDEX stands for: Reader's Data 
Exchange. We print what you write. When 
you send in articles, softkeys, APTs, ete., you 
are submitting them for FREE publication in 
this magazine. RDEX does NOT purchase 
submissions nor do we verify data submitted 
by readers. If you discover any errors, please 
let us know. 

• Remember that your letters or parts of them 
may be used in RDEX even if not addressed 
to die RDEX editor. Correspondence that gets 
published may be edited for clarity, grammar 
and space requirements. 

• Because of the great number of letters we 
receive and the ephemeral and unpredictable 
qqiearance of our part-time staff, any response 
to your queries will s^>pear cmly in RDEX, so 
it would be more jqipropriate for you to present 
technical questions to the readers and ask for 
their responses which will then be placed in 
die Apple-RDEX. 

• Whenever possible, send everything on 
SV*' disk. Use whatever text editor you like, 
but teU us which one. Put a label on the disk 
with your name (or pseudoi^rm) and address 
(if you want to receive mail). Don't reformat 
any programs. Send Applesoft programs as 
normal Applesoft files and machine language 
programs as normal binary files. We have 
programs to convert them to the pn^r format 
for printing. If you are sending source code 
files, send them as normal text files. We will 
return your disks, whenever possible, with the 
current library disk copied onto it. 

• Don't send hardcopy (printout) unless it is 
about a bug or other printing error, (ffyou are 
writing about your subscription or sending an 
order, do scad your letter cm paper. Karen 
keeps the hardcopy and forwards the disks.) 

• If you use a pen name and want to receive 
mail, we need to have your address. Our 
readers privacy is important, so we will not 
print your address unless you specifically say 
too. 

• When writing to request help, be sure to 
include ALL relevent information. The more 
information you include, the easier it is to find 
a solution. 

• When writing to one of the RDEX authors. 
Write your letter and seal it in an envelope. 
Put your return address, the authors name (as 
it appears in RDEX) and the correct postage 
on the envelope. Put this envelope into anodier 
and send it to RDEX. We will put the correct 
address on your letter and mail it. 
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You have a LEGAL RIGHT to an unlocked 
backup copy off your commercial soffware 

Our ecf/ioiia/ polcy Js that we c(o NOT condone softmre piracy, but we do be/feve 
^t users are entWed to iMCkup commerc/al disks thejr han puichased. 

In Mnion to the securftj/ of a backup disk, tfie renwvai of copjr-protectibn gims 
tiie user the option ot modi^ng programs to meet his or hot needs. 

Furthermoie, the copyright laws guarantee your dgiit to sucii a DEPROTECTED 
liackup copy: 

..."It Is not an infringement for the owner of a copy of a computer progiwn to 
make or authorize the making of another copy or adaptatibn of that computer piogran 
provided: 

1) that such a new copy or adaptatkMi is created as an essential step In the 
utilization of the computer program in conjunction with a machine and that it is used 
in no other manner, or 

2) that such new copy or adaptation is for archival purposes only and that aii 
archhnii copies are destroyed In the event that continued possession of the computer 
program should cease tolw rightful. 

Any exact copies prepared in accordance with the provisions of this section may 
be leased, soM, or othemvise transferred, along with the copy from wMch such copies 
were prepared, only as part of the lease, sale, or other transfer of all rights in the 
program. Adaptations so prepared may be transferred only with the authorization of 
the copyright owner." 

UnHedSMu Code tUe 17, S117 
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I've been banging my head against a wall for a long 
time, trying to keep COMPUTIST going. Some of you 
have been with us for an equally long time and are already 
aware of what's going on. Some of you are new to 
COMPUTIST and don't know what I'm talking about. 
Some of you don't believe me. 

To those few who don't believe, I say this; Call any 
large printer in your area, ask them for a quote on a 5000 
copy, SV2" by 11", 48 page, self-cover, on 40 lb book 
stock, with one color besides black on one signamre, 
saddle stitched and delivered. Then call your neartest USPS 
bulk mailing center and ask how much a bulk mailing 
permit is and what the current cost of mailing 4000 copies 
of a 4 oz magazine is. Then call a local typesetter and ask 
what the cost of typesetting 48 pages of text (point size 
9, line space 10) plus various sized heads using a 2600 
lines/inch phototypesetter will cost. After that, you will 
have some idea of what we are up against for every issue 
we send out to you. And that doesn't include rent, 
telephone, water, electric, insurance, equipment 
maintenance, daily postage, UPS service, bulk mailing 
services, foreign mail fowarding services, state and local 
business operating taxes, business property (computers) 
taxes, etc, etc, etc... Sometimes the list seems endless. 

The volunteers who come here hate the donkey work 
but love the magazine. If it weren't for the support of the 
volunteers and many of our hardcore readers, I would have 
given up long ago. 

Whew! Thanks for letting me get that out. Now, let's 
put that behind us, get out and kick some rears, and put 
this rag back on track. 

I've got a lot of information for you. Please take the 
time to read this, it's important. We are at a crossroads 
here and the next few months are going to see some 
dramatic changes, for better or for worse. Read the rest 
of this editorial and then, sit down and write a long letter 
to me. Tell me what you like, tell me what you hate, praise 
me or curse me, but sit down and write. It's important 
that you let me know what you think. 

Wby we're in trouble 

If you divide COMPUTIST's average monthly 
operating costs by the number of subscribers and multiply 
by 12 issues, the cost of a one year subscription should 
be around $48. As printing and other costs went up, the 
cost of a subscription should have followed. But we got 
so much negative feedback and outright cancellations when 
we first went to $32/year that we have been reluctant to 
ask for another increase. 

For the longest time, the magazine has been subsidized 
by back issue and disk sales. (That's why those prices 
haven't come down.) The average new subscriber spends 
about $60 dollars on back issues and library disks. Part 
of that is added to the $32 subscription fee to get $48. The 
rest goes to supplement ordinary renewals from our regular 
readers. This has worked for some time, but it is a false 
security and a five month long drop in back issue sales 
pointed out how fragile our house really was. So we are 
looking at all possible options very closely. I think you 
should all take a close look at the following options and 
perhaps someone out there has some other ideas that could 
help. 

Option 1 - raise the rates 

Change the subscription rates to $48. Ugh! Yuck! 
Forget it! Aside from a few of us, who could afford this, 
most of us would be hard pressed to come up with the 
extra bucks. We would, reluctantly, let our subscription 
lapse. Besides, I don't want to answer the nasty letters, 
full of rude suggestions, that I would surely receive. I've 
already gone thru that once. 

Option 2 - Increase our (paid) readership 

We figure that an increase to 8000 readers will allow 
us to meet all bills using the subscription money alone. 
More readers means a larger press run and that will save 
money. Printers dislike small press runs. They have to 
charge more and can't make any money. The reason is 
the setup charges. Here's a rough idea of how it goes. 

1 . Prepare the paste-up pages so negatives can be shot. 
Also strip in the color overlays. 

2. Shoot the negatives and check fliem for errors, spots 
etc. 



3. Make the printing plates from the negatives. 

4. Mount the plates on the presses. 

5. Load the paper rolls and ink. (5 stations are used for 
a tabloid, 3 stations for the magazine.) 

6. Start the press and adjust the alignment so the pages 
are correctly positioned when the sheet is folded. Also 
clean any smudges and adjust the ink feed. 

Note: While this is going on, the press is running at 
reduced speed but it is still wasteing paper and ink. 
Everything that conies out of the press is thrown away as 
scrap. The initial setup plus running alignment takes about 
2 hours. 

7. Everything is correct, start counting the copies. At 
this point the press can be brought up to speed. 4000 copies 
takes about 12 minutes. 

8. Shut down the presses. 

9. Unload and store the 5 rolls of paper. A single roll 
can print 3 issues so these 5 rolls will be used again for 
the next 2 issues. 

10. Clean the presses so they will be ready for the next 
job. Cleaning takes a long time, also. 

As you can see, only a small amount of the total time 
is spent actually printing our 4000 copies. So, doubling 
the number of copies would not double the cost. Only the 
paper and ink charges would increase. The setup charges 
would be the same. 

Increasing our readership is obviously the best solution 
to our problem. 

Option 2a - The Readers Wish List 

One idea, suggested by a reader, is to give software 
prizes for finding new subscribers. 

We would compile a list of software, using the wish 
lists that you send us. (You are sending your list, aren't 
you?) Each piece of software would have a point value, 
based on its wholesale cost. (IE. A game might retail for 
$49 but actually cost a dealer only $32. It's point value 
would be 32.) 

For every new (paid) subscription that you bring in, 
you would accumulate 5 points. These points would then 
be used to get free software from the list. No, renewals 
don't count, rememb^, we're trymg to find new readers. 

We will send any subscriber, who is interested, one 
copy of our new info flyer, with your name and record 
number printed on it, next to the subscription form. You 
would make copies of the flyer and give them to other 
Apple owners. The information flyer tells about the 
magazine so all you really have to do is take a little time 
and pass them out. Are there any computer shows, 
computer swap meets, Apple clubs, etc., in your area? 
Well, here's your chance to help us and yourself. 

Option 3 - Lower the rates 

Are you kidding? Well, maybe. It was suggested that 
lowering the rates might inspire more subscriptions, which 
could, in the long run, make those rates feasible. (Has 
anyone calculated how long?) 

One way to achieve lower rates is to print less often. 
As most of you have heard by now, we are "suggesting" 
a move to a 8 time per year publishing schedule. The 
primary reason for this is to lower the cost of a 
subscription. Other than a 3 fold increase in the number 
of subscribers, nothing else would allow us to lower the 
rates. 

It seems pretty silly to reduce our publishing schedule 
when we are receiving more and more material from you, 
our readers. We should be increasing the number of 
pages/issue not reducing the number of issues. I need those 
exfra pages, but many of you are annoyed enough at the 
$32 per year cost and would not be friendly towards an 
increase. 

Going to 8 issues would allow us to reduce the 
subscription rate to $24/yr. Here's the current page 
breakdown for a normal 48 page issue: 

1 Front Cover 

2 Inside Front - Masthead 

3 Subscription ad 

4 Authors list and Editorial page 

5 Table of Contents 

6 Data Page 

7-37 Apple RDEX (31 pages) 
38-42 Back issue list (S pages) 
43 Shopper Ad 
44-45 IBM RDEX (2 pages) 
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46 unclassified ads 

47 Inside back - outside ads 

48 Bajck cover - house ads 

Counting the Audiors list and Table of Contents, 33 
out of 48 pages are used for the Apple RDEX. There are 
some things I can do to increase tiliis number. 

• We currently use a point size of 9 with a line space 
of 10 for our body text. Other magazines use point size 
10 with a line space of 11. Our slightly smaller print 
already packs more information per page than the usual 
magazine (about 1 extra page for every 8 pages of text). 
But I can use the "Set Size" function on the typesetter 
to make the print just a hair thinner. This saves about l/9th 
of a page or, you could say, adds 1 page for every 9 pages 
of text. 

• The RDEX logo is cute but it eats up 1/2 inch at the 
top of each page. Recovering that space gives us another 
page for every 20 pages. 

• We can use 3 columns for the BASIC program 
checksums, instead of 2, and go one point size smaller 
on the BASIC program listings. 

• We can axe the back issue Ust and print it only once 
or twice a year. This would free more 5 pages. 

• I can also move some pages around to allow "tear- 
outs". I know, most of you would hang anyone who tore 
a page out of one of your issues. But some of you do tear 
pages and, t<x them, this would make it a little less painfiil. 

Here's what we end up with. 

1 Front cover 

2 Inside front - Masthead and RDEX info 

3 Data page or ads Tear-out 

4 Subscription ad Tear-out 

5 AuAors list and Editorial 

6 Contents 

, 7-42 Apple RDEX (36 pages) 
43^»4 IBM RDEX (2 pages) 

45 Shopper ad Tear-out 

46 unclassified ads Tear-out 

47 Inside back - other ads 

48 Back cover --other ads 

You'll notice, the tear-out pages are all ads of one sort 
or another and match each other in the front and back of 
the issue. 

Counting die Authors list and Table of Contents, there 
would be 38 pages for Apple RDEX. But wait, let's not 
forget the extra page we get from deleteing the RDEX logo 
and the 1 in 9 boost with type width compression. 9 goes 
into 38 about 4 times. This means 5 more pages or an 
effective total of 43 pages of text, compared to previous 
issues. Now let's see... The new page count, (43), times 
8 issues/year is 344. Divide this by the old page count 
(33) and you get 10 plus a little. With the new subscription 
rates, you pay for 8 issues but get 10 issues worth of 
information. That makes me feel a little better, but I'll 
keep working on it to see if there isn't something else we 
can do. 

Option 3a 

We could use the 8 issue subscription to lower the 
renewal rates but continue to publish each month. This 
means that you would get your renewal notices every 8 
months instead of every 12. The "all at once" out of 
pocket expense would be lower ($24) while the real 
subscription cost remained the same. 

Option 4 - Tabloid & book 

This issue is printed in the tabloid format. For less 
cost than the current 48 page issue, we can print a 40 page 
tabloid. The paper used is a high quality newsprint called 
"Electrabrite". It is smoother and whiter than newsprint 
but, since it is newsprint, it is less expensive than the book 
paper we use now and can be printed on a less expensive 
press. The text area of this tabloid is 10" by BW ". Our 
regular page is about 7V4" by 10". That makes a tabloid 
page almost twice the size of a regular page. A 40 page 
tabloid is like getting an 80 page issue. You would receive 
double the amount of information and I would have more 
room for all the material that you are sending now. 

At the end of each year, we were thinking of 
compiling all the data and printing a book. A big book. 
Only those who needed a long time archive copy would 
need to buy the book. 

Another option would be to print the ' 'book' ' as loose 
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SVi" by 11" sheets with 3-holes for a 3-ring binder. 

I'd like to cast my vote for the tabloid format. I have 
a lot of information ready to be printed and more coming 
in every day. I really need those pages. Remeniber, our 
greatest strength is our ability to print your questions and 
letters quickly. But letters are coming in faster than I can 
print them using our regular format. Some material in my 
in file has been waiting almost 2 months to be printed. 
The softkey you need may be in there. Give me those extra 
pages and I'll double the information you get each issue 
and bring down the time to get letters printed too. I may 
be greedy, but I want those extra pages. 

One other thing to consider. With the tabloid format, 
the per page cost is less so the advertising cost is less. 
Maybe we can pick up some new advertising with lower 
rates. Anything to help pay for the issues. 

Option 5 - Frequent issues 

I know it sounds crazy but I certainly have enough 
material to warrant it, and this is what everyone I talked 
with wants. How can we save by printing more often? 
Well, it's a trade-off. The 3 biggest bills are for printing, 
mailing and typesetting. Printing an issue every 2 weeks 
means that you would have to renew sooner. (Twice a 
year, double the prirting would double the 1 year sub rate.) 
The subscription rates would pay (?) for the increased 
printing and mailing cost. Any savings would come from 
typesetting. The typesetting equipment is on a lease. We 
pay the same amount each month whether we use it or 
not. Using it more often would only increase the cost of 
film and chemicals. We calculated the lease, maintenance 
and materials for one year, divided by 12, and came up 
with $2300 per month. Only half of that would apply to 
each issue. This reduces the per issue cost. 

It sounds like you can have your cake and eat it too 
but there are some other considerations. 

1 . Everyone would have to send all their letters to 
RDEX, on disk, even the short letters. Two weeks leaves 
very little time to edit and no time at all to type in letters. 
Don't forget, your disk is returned with the current library 
disk copied onto it. So you don't lose anything. And you 
can use any text editor or word processor that you own 
and send it on a DOS or ProDOS disk. (Use only a 5 H " 
disk at this time.). 

2. We would have to start slow and gradually reduce 
the time between issues. That way, we would have time 
to work out any bugs. Also, the Tacoma area subscribers 
should give some serious thought to stopping by and 
helping out. 

3. If you decide you like the idea of more frequent 
issues, you should also consider the tabloid idea. Frequent 
printing and the tabloid would go together well. (You like 
ice cream with your cake?) 

The Nit'is Grit'is 

The bottom line is still the same, we need to double 
the subscription rates or double the number of subscribers. 
The latter solution is the best. We, all of us, need to do 
our part to find more subscribers. If you have any ideas, 
please write and tell me. There's almost 4000 of you out 
there, and if we all think about it, we're bound to come 
up with some good ideas. 

The free software giveaway (detailed in the flyer) is 
one step in that direction. We hope it will get people talking 
about us, and maybe they'll take a look at COMPUTIST 
too. If it works, then we can take more $money$ away 
from what we spend on commercial ads and use it to 
increase the amount of software given away in each issue, 
but only if it works. 

A healthy magazine needs a strong subscriber base 
and like the saying goes, "There is strength in numbers". 

Best BASIC program 

While we're on the subject of free software, I've got 
an idea for another way to win. Many of our subscribers 
would like to see more BASIC program listings. I propose 
that we add another piece of software to the 4 pieces that 
are going to be given away each issue. This one would 
be for the best BASIC program in each issue (not counting 
the Super lOB controllers). Let me know how you feel 
about this, or how you feel about the whole idea of the 
ft-ee software giveaway. Is it a good idea or a bad one? 
Should there be catagories or should it just be the 3 or 



4 best articles, period? How should the categories be set 
up? (Best BASIC program, best softkey, best machine 
language routine, most informative, etc.) If we do this 
right, we can use the free software program as incentive 
to improve the quality of the material in the issues. I need 
your feedback on this. Sit down and write me a letter, right 
now! 

Help lines 

Jack Nissel called the other day and suggested that 
we have telephone "help" lines. I think it's a great idea. 
Would any of you be interested in receiving calls from 
other subscribers needing help? If you are, write and let 
me know your number, the times (and your time zone) 
that you would be available sund the subject(s) you feel you 
can help out with. Sometimes, all someone needs to get 
out of trouble is a few words from someone who's been 
there before. 

Callers to these help lines should insure that they have 
all the details of their problem/qiiestions ready besfore they 
call and, most of all, they should respect the times given 
for that help line. Don't forget the time zones. 

The Beginners Notes 

We need some volunteers to help compile a beginners 
notebook for new subscribers. This notebook should 
contain the best of the tutorial articles from past issues. 
This job would involve a lot of editing and rewriting. One 
article for each of the major protection schemes needs to 
be selected and updated. Also, a complete glossary of 
terms used in Computist and general topics such as DOS 
and ProDOS workings, Applesoft BASIC, machine code, 
Apple internals, etc. should be covered. (A complete set 
of issues would be very helpful.) We can load the text for 
any past article onto a disk for editing. If anyone is 
interested in working on this, please contact the RDEX 
editor. Any help would be greatly appreciated. 

Bounties for the Most Wanted 

A reader has suggested that instead of dropping 
program names from the most wanted list, we offer a 
bounty for stubborn programs. I think he has a good idea, 
if it's done right. 

We will stiU drop programs from the most wanted list 
after 6 issues. This cleans out the deadwood and forces 
you to keep the list current by sending new wants for the 
list. But if you think a program has been on the list too 
long, then write us and nominate it for a bounty. If at least 
1 % of the subscribers nominate a program, then we will 
put a bounty on it. A certain number of points based on 
how many readers voted for it. (Remember, points are 
good for free software from the wish list.) 

We won't tell you which programs have a bounty. 
Instead, we will tell the number of bounties in each Most 
Wanted list. That way readers won't be tempted to sit on 
a softkey and wait for a bounty. 

What do you think? Is that a good idea? Should we 
do it? 

Wish list 

We are compiling a list of software for our free 
giveaway. Send us your wish list of software (hardware?). 
Be honest and don't get crazy. No requests for MAC II's 
or Cray computers please. Tell us what software you 
would really like to have but can't afford or just haven't 
got around to buymg yet. You just might be the first winner 
in our giveaway. 

Club news 

The first response to the club flyer came by telephone 
on Friday (April 14). Bob Kesslick is the first official 
member of the Hardcore Computist Club. Thanks Bob. 
It's nice to know who our hardcore supporters are. As of 
today (May 9) there are 700 members in the club. Over 
20% of those members sent more than $10. That's the 
good news. 

The bad news is that we need a 63% response to get 
out of the hole we're in. Where are the rest of you? I 
remember an old saying "When you're -ss deep in 
alligators, you don't have time to worry about how deep 
the water is" . Well, we've been beating off the alligators 
with a short stick. We need your help to get Computist 
out of the water and back on solid ground. 

If you haven't joined the Conqwtist Qub, do so today. 
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And if you know anyone who may be interested in our 
newsletter, talk to them today and convince them to 
subscribe. 

Send us a postcard or call us at (206) 474-5750 and 
request a copy of the Computist Info Flyer. Remember 
Option 2a, you can get free software for finding new 
subscribers. If we all pull together, we can make this the 
best user supported magazine, anywhere. 
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Ilgs Softkey for... 



Ilgs Softkey for.. 



Calender Crafter 

MECC 



■ Requirements 

D Apple Ilgs 512K 
D 3 Vi " disk copier 
D 3>A" disk editor 

Calender Crafter (CC) from MECC is a great program 
for making personalized calenders. You can even add GS 
SHR (Super Hi-Res) pictures if you have 768K in your 
GS. The type of protection used is a bad block check on 
block $7. I scanned the disk for 22 A8 00 El 22 and found 
it on block $604. After much checking I found the routine 
that makes it's calls to the block read routine. It is on block 
$603 and looks like this (on the disk): 



El 



10C:A9 00 00 
10F:8FF3 66 01 
113:20 65 08 
116:A2 04CA 
119:22 00 00 El 
11D:6B 
11E:22A8 00 
122:2100 
124:DD09 00 
127:00 
128:80 46 
12A:20 4A09 
120:90 05 
12F:C9 27 00 
132:F0 3B 
134:A9 0100 
137:80 DO 09 
13A:20 4A09 
13O:B0 30 
13F:EEDD09 
142:C9 1100 
U5-.D0F3 
147:A2 04CA 
14A:22 00 00 
14E:48 
14F;F4 00 00 
152:F4 0A09 
155:F4 00 00 
158:F4 00 00 
15D:A2 15 17 
I5E:22 0! 
162:68 
163:C9 0100 
166:F0CC 
168:A9FFFF 
16B:8FF3 66 01 
16F:60 
170:4CF6 0O 



LOA #0000 
STA 0166F3 
JSR 08B5 
#CA04 
E10000 



LDX 

JSL 
RTL 
JSL 



Load pass value 
&ore in the pass/fmlflag 
Go check for the origiml 



Return to calkr 

E100A8 ProDOS 16 interface (MUj 

0021 Call number (GH LAST DEVICE) 

0009DD Farm table location in memory 

00 End of MU parm table 

BCS 170 (+46) Had an error, goto hang 

JSR 094A Read the bad block $7 

BCC 134 (+05) Carry clear = no bad block 

CMP #0027 m7=llO error from disk interface 

BEQ 16F (+3B) bad block, so it's an original 

Start with first device on line 

Store in parm table 



El 



El 



LOA #0001 

STA 09DD 

JSR 094A 

BCS 16F (+30) 

INC 09DD 

CMP #0011 

BNE 13A (-00) 

LOA #CA04 

JSL E10000 

PHA 

PEA 0000 

PEA 090A 

PEA 

PEA 

LDX 

JSL 

PLA 

CMP 

BEQ 

LOA 



#1715 
E10000 



Check for a bad block $7 

If an error, then continue 

Try next device 

Any devices lefil 

If yes, goto 13 A 



Out of devices 
Set up for asking user 
to 'Insert the Calender 
Crafter master disk...' 

Print it 



#0001 0001 = continue 

134 (-34) So try again 

#FFFF forget it, let's quit 

STA 0166F3 Mess up pass/fail flag 

RTS Return to the sender 

JMP 0DF6 Print some stuff & hang 

After some checking around I found the JSR 08B5 
is the call to the bad block check. However, I thought I 
would check the disk for all references to F3 66. 1 found 
two checks of $66F3 (for a zero) and one place where it 
incremented $66F3. 1 found that calls to the beginning of 
the disk check look like JSL 000A95 (22 95 0A 00). So I 
scanned the disk for that sequence and found four calls 
to it. After finding so many calls to the protection, I 
decided to just cancel the JSR 08B5 (a single byte edit) 
instead of going through and changing all references to 
$66F3 and 0A95 (almost 30 bytes). Well to wrap this one 
up, it works! If you don't find the 20 B5 08 on block $603, 
then search the disk for 8F F3 66 01 20 85 08 and change 
the 20 to AD. 

[T]Make a copy of the disk (ignore any read errors). 



I 2 [ Edit the copy. 
Block Byte(s) From 



To 



$603 $114 



20 



AD 



I 3 I Write the block back to the copy. 

Optional: upload the program to your Hard Disk. 



California Games 

Epyx 



■ Requirements 

D Apple Ilgs 512K 
D VA" disk copier 
D 3V2" disk editor 

California Games has been released in a fiill GS 
format, with great GS SHR (Super High Resolution) 
screens. Like most GS programs from Epyx, they are 
using the old VA" disk nibble counting routine. This 
routine is more like the one used on Street Sports Soccer, 
rather than Destroyer. On the boot, ProDOS 16 runs 
CAL.SYS16 which sets the prefix to volume/OBJECT, 
then runs the program CALIF.GAMES. It's the file 
CALIF.GAMES that contains the protection and a single 
call to that routine. The protection routine looks like this 
on block $FC: 



40:20 C5 52 

43:08 

44:18 

45:FB 

46:08 

47:C2 30 

49:ADC9 52 

4C:48 

4D:22D2 52 00 

51:A8 

52:68 

53:90 03 

55:4C93 52 

58:E2 30 

5A:A2 20 

5C:A0 01 

5E;5A 

5F:0A 

60:F4 00 00 

63:F4AA52 

66:22 93 53 00 

6A:8E9E52 

60:8C9F52 

70:A8 

71:68 

72:68 

73:68 

74:68 

75:68 

76:68 

77:90 03 

79:4C93 52 

7C:A2 21 

7E:A0 01 

80:5A 

81:0A 

82:F4 00 00 

85:F4AA52 

88:22 93 53 00 

8C:8DD0 52 

8F:8EA4 52 

92:8CA5 52 

95:A8 

96:68 

97:68 

98:68 

99:68 

9A:68 

98:68 

9C:90 03 

9E:4C93 53 

A1:C2 30 

A3: 22 76 53 00 

A7:28 

A8:FB 

A9:28 

A8:18 

AC:FB 

AD:08 

AE:C2 30 

80:A0FFFF 

B3:AD9E52 

B6:CaA0 52. 



#30 
52C9 

0052D2 



JSR 52C5 

PHP 

CLC 

XCE 

PHP 

REP 

LDA 

PHA 

JSL 

TAY 

PLA 

BCC 58 (+03) 

JMP 5293 

SEP #30 

LDX #20 

LDY #01 

PHY 

PHX 

PEA 0000 

PEA 52AA 

JSL 005393 

STX 529E 

STY 529F 

TAY 

PLA 

PLA 

PLA 

PLA 

PLA 

PLA 

BCC 7C(+03) 

JMP 5293 

#21 

#01 



Enter fidl GS mode 
16-bit wide Accum. 



Goto the fail routine 

84>it wide Accum. 

Track $20 

Side 

Push side 

Push track 

Push disk/volume name 

Goto the nibble count 

Store hdfor nibble coma sum 

Store the other half of the sum 



52AA 

005393 

5200 

52A4 

52A5 



LDX 

LOY 

PHY 

PHX 

PEA 

PEA 

JSL 

STA 

STX 

STY 

TAY 

PLA 

PLA 

PLA 

PLA 

PLA 

PLA 

BCC Al (+03) 

JMP 5393 

REP #30 

JSL 005376 

PLP 

XCE 

PLP 

CLC 

XCE 

PHP 

REP 

LDY 

LDA 

CMP 



Pull all extra values from the stack 
Carry clear = no read errors 
Goto the fail routine 
Track $21 
Side 
Push side 
Push Track 

Push disk/volume name 
Goto the nibble count routine 

Store half of nibble count sum 
Store the other half of the sum 



Pull all extra values from the stack 

Carry clear = no read errors 

Goto the fail routine 

16-bit wide Accum. 



Back to He emulation mode 



Now to full GS mode 



#30 
#FFFF 
529E 
52A0 



16-bit wide Accum. 



COMPUTIST#66 



Load nibble coimt sum for track $20 
Compare low end bench mark 



BE: 
CI: 
C3: 
C6: 



89:90 10 

8B:A0 9E52 
:CDA2 52 
:80 15 
:ADA4 52 
:CDA6 52 

C9:90 0O 

CB:A0A4 52 

CE:CDA8 52 

O1:B0 05 

03:28 

D4:FB 

05:28 

06:18 

07:60 

D8:C2 30 

0A:5A 

06:22 76 531 

0F:7A 

E0:4CC8 52 

E3:00 00 

E5:08 20 

E7:02 21 

E9:00 00 

E8:60 1D 

ED: 78 IE 



BCC 08 (+10) Too low, then goto fail routine 
LDA 529E Reload sum for track $20 

CMP 52A2 Compare to Mgh end bench mark 

BCS 08 (+15) Too Mgk then goto fail routine 
LDA 52A4 Load nibble count sum for track $21 
CMP 52A6 Compare to low end bench mark 

BCC 08 (+00) Too low, then goto fail routine 
Reload sum for track $21 
Compare to high end bench mark 
Too high, then goto fail routine 



LDA 52A4 

CMP 52A8 

BCS 08 (+05) 

PLP 

XCE 

PLP 

CLC 

RTS 

REP 

PHY 

JSL 

PLY 

JMP 



#30 



005376 



Return to He emulation mode 

Made it this far, it's an original 

Set flag for a pass condition 

Return to sender 

16-bit wide Accum. 



52CB 



2008 
2102 



1DB0 
1E78 



Jump to the fail rouAne 
Nibble count sum storage (track $20) 
Track $20 low end bench mark 
Track $20 high end bench mark 
Nibble count sum storage (track $21) 
Track $21 low end bench mart 
Track $21 high end bench mark 



EF:43414C4741404553 CALGAMES Disk/volume name in ASCH 

The call to the protection looks like this on the first 
block of CALIF.GAMES (block $D2) and is called like 
this: 

92:20 FB 51 JSR $51F8 
95:90 03 BCC 98 (+03) 



Go do the protection routine 
Carry set = an original 



The best way around this protection is to change the 
JSR (20) to LDA (AD) and the BCC (90) to BRA (80). The 
program is now completely deprotected. While I have 
NOT tried it, I think the new copy should be hard disk 
compatible. 

I 1 I Make a copy of the game disk. 

[T] Edit the copy. 

Block Byte(s) From To 



$02 



$92 

$95 



20 
90 



AD 
80 



I 3 [ Write the block back to the copy. 
Ilgs Softkey for. . . 



Serve & Volley 

Accolade 



I Requirements 

D Apple Ilgs 512K 
D 3 '/a" disk copier 
D 3'/4" disk editor 

Serve & Volley (SV) from Accolade is a tennis 
game/simulation along the same lines has Hardball and 
4th & Inches. It would seem that Accolade has moved to 
the 3 14 " disk nibble count routine for it's copy protection. 
This is nice, as it's a little easier to find and bypass then 
the protection used on Hardball. Searching the 16 bit 
system file for "A2 20 A0 1 " failed to find the protection 
routine. After checking all the different files on the disk 
I found a permanent initialization file (type $B7) called 
STARTIT in the volume/SYSTEM/SYSTEM. SETUP 
subdirectory. Scanning this file for the above string did 
reveal the protection, which looks like this (on the disk, 
block $DD): 



0DF:E2 30 
0E1:A2 20 
0E3:A0 01 
0E5:20B4I 
0E8:B0 0C 
0EA:A2 21 
0EC:A0 01 
0EE:20 84I 
0F1:B0 03 
0F3:A9 00 
0F5:60 
0F6:A9 01 
0F8:60 . 
0F9:8ED3f 



SEP #30 
LDX #20 
LDY #01 
JSR 0084 
BCS F6 (+0C) 
LDX #21 
LOY #01 
JSR 0064 
BCS F6 (+03) 
LDA #00 
RTS 

LDA #01 
RTS 
STX 00D3 



Siit wide Accum. 
Track $20 

Go to the protection routine 

Carry set = copy/error 

Now for track $21 

Go to the protection routine 

Carry set = copy/error 

Passed, so load the pass value 

Return to sender 

Failed, so load the f ml vake 

And still return to sender: 

Store the Track nund>er 



* Heideifg Date Exchange < 



0FC:8CD4 00 

0FF:5A 

100: DA 

101:F4 00 00 

104:F4D6 00 

107:22 AC 01 

10B:8DD5 00 

10E:68 

10F:68 

110:68 

111:68 

112:68 

113:68 

114:ADD5 00 

117:60 

118:20 

119:01 

11A:00 

11B:484C532E534947 



STY 00D4 
PHY 
PHX 

. PEA 0000 
PEA 00D6 
JSL 0001AC 
STA 00D5 
PLA 
PLA 
PLA 
PLA 
PLA 
PLA 

LDA 00D5 
RTS 

20 

01 

00 

HLS.SIG 



Store the side number 

Push side onto stack 

Push track onto stack 

Push disk name/volume 

Go to the actual protection 

Store the result 



Pull extra values from the stack 

Load the results 

Return to caller 

This is D3 {track) storage 

This is D4 (side) storage 

This is D5 (result) storage 

This is D6 (disk vohunej storage 



There are two calls to the routine which look like this 
(still on block $DD): 



70:E2 30 
72:20 9A00 
75:D0 02 
77:80 17 
79:20 9A00 
7C:D0 02 
7E:80 10 
80:38 
81:FB 

82:F4 00 00 
85:28 
86:A9 00 
88:48 
89: AS 
8A:5CA6FAI 



SEP #30 

JSR 009A 

BNE 79 (+02) 

BRA 90 (+17) 

JSR 009A 

BNE 80 (+02) 

BRA 90 (+10) 

SEC 

XCE 

PEA 0000 

PLD 

LDA #00 

PHA 

PLB 

JMP 00FAA6 



8 bit wide Accum. 

Do the protection 

Branch on fail 

Passed, goto continue code 

Try the protection one more time 

Branch on fail 

Passed, goto continue code 

Set up for full GS mode 

Switch to full GS mode 



Mess up program! 



The best way (I found) to bypass the protection routine 
is to change the LDX #20 (A2 20) at $E1 to BRA F3 (80 
10) which is the pass section of the code. The resulting code 
will jump straight to the pass section of the code instead 
of actually going through and reading for the nibbles. 

I 1 I Make a copy of the game disk. 

I 2 [ Edit the copy. 

Block Byte(s) From To 

$DD $E1 



A2 20 



10 



[T] Write the block back to the copy. 
Ilgs Softkey for. . . 



The Last Ninja GS 

Activision 



■ Requironents 

D Apple Hgs 512K 
D 3 '/2 " disk copier 
UVA" disk editor 

The Last Ninja (TLN) is an incredible game for the 
GS! Imagine a 3D version of Karateka with weapons and 
GS SHR screens and you can begin to imagine TLN. The 
game uses joystick (or keyboard) control and you can save 
the game at any point. These features will come in handy 
while trying to solve the arcade/adventure game. 

The game disk has a bad block over block $63F (the 
last block of the disk) and checks it through a simple 
ProDOS 16 block read. The whole protection looks like 
this on block $CD: 



I6B:C2 30 


REP #30 


Start of protection 


16D:9CEFC4 


STZ C4EF 




170:22 A8 00 El 


JSL E100A8 


ProDOS 16 MU call 


174:20 00 


0020 


GH-DEVICE 


176:FBC4 00 


00C4FB 


Parm table location 


179:00 


00 


End of MU parms 


17A:90 25 


BCC lAl (+25) 


On right disk, continue 


17C:E2 30 


SEP #30 


8 bit wide Accum. 


17E:A9 01 


LDA #01 




180:8DEFC4 


STA C4EF 




183:A9 00 


LDA #00 




185:85 44 


STA 44 




187:22 49 00 00 


JSL 000049 





18B:A9 16 
18D:22DF0D 
19I:A9 19 
193:22DF0D 
197:22 C6 01 
19B:90FA 
19D:C2 30 
19F:80CF 
1A1:ADFFC4 
1A4:8DF1C4 
1A7:9CF9C4 
1AA:A9 3F06 
1AD:8DF7C4 
lB0:i22A8 00 
1B4:22 00 
1B6:F1C4 00 
1B9:00 
1BA:90C0 
1BC:C9 27 00 
1BF:D0BB 
1C1:ADEFC4 
1C4:F0 0C 
1C6:E2 30 
1C8:A9 00 
1CA:85 44 
1CC:22 49 00 
1D0:C2 30 
1D2:E2 30 



El 



LDA #16 

JSL 000DDF 

LDA #19 

JSL 000DDF 

JSL 0001C6 

BCC 197 (-06) 

REP #30 

BRA 170 (-31) 

LDA C4FF 

STA C4F1 

STZ C4F9 

LDA #063F 

STA C4F7 

JSL E100A8 
0022 
00C4F1 



Ask for Master disk 

16 bit Me Accum. 

Go get device number 

Right disk, check for bad block 



Bad block number 

Store in parm table 

ProDOS 16 MIL 

BLOCK-READ 

Parm table location 

End of MLI parms 

No error, ask for master 

$27 = 1/0 error, bad block 

Different error, ask for master 



An original, start the game 
8 bit wide Accum. 



16 bit wide Accum. 
Start game/continue code 



BCC 17C (-40) 
CMP #0027 
BNE 17C (-45) 
LDA C4EF 
BEQ 1D2 (+00 
SEP #30 
LDA #00 
STA 44 
JSL 000049 
REP #30 
SEP #30 

So, from looking at the above disassembly, I changed 
the REP #30 (C2 30) at 16B to BRA 1D2 (80 65) and had 
a kracked copy! Now you can upload the program to your 
hard drive and never pull out the original for a key disk 
check. 

A quick tip: When kracking a disk with a bad block, 
many times searching for C9 27 will reveal part of the 
protection. The reason for this is when the smart port (built 
in GS disk controlling ROM) encounters a I/O error (bad 
block) it returns a 27 (or 0027 for 16 bit) in the 
accumulator. 

I 1 I Copy the game disk. 

I 2 I Edit the copy. 

Block Byte(s) From To 



$CD $16B 



C2 30 



65 



I 3 I Write the block back to the copy. 
Ilgs Softkey for... 



Stickybear Alphabet 



Optimum Resource 



■ Requirements 

D Apple Hgs 512K 
D VA" disk copier 
nvh" disk editor 

Stickybear Alphabet (SA) is an educational program 
by Optimum Resource that has been released in a GS 
format. The program has very nice voice systhesis and 
good graphics. The program comes on two disks with the 
boot disk having an unformatted track. There is a simple 
cheek for the bad blocks from the file ABC.SYS16 on disk 
one. The protection routine looks like this on block $FE: 



20:22 A8 00 El JSL 

24:20 00 

26:01 19 00 

29:00 

2A:90 05 

2C:20DC18 

2F:80EF 

31:AD05 19 

34:8D0F19 

37:22A8 00E1 

3B:22 00 

3D:0F19 00 

40:00 

41:B0 02 

43:80DB 

45:60 



E100A8 

0020 

001901 



BCC 31 (+05) 

JSR 18DC 

BRA 20 (-11) 

LDA 1905 

STA 190F 

JSL E100A8 
0022 
00190F 
00 . 

BCS 45 (+02) 

BRA 20 (-25) 

RTS 



ProDOS 16 m 

GET-DEVICE call 

Parm table location 

end of MU parms 

On right disk, corttinue 

Ask for original 

Go start over 

Load device number 

Store in block read parms 

ProDOS 16 MU 

. READ-BLOCK call 

Parm table location 

End of MU parms 

Carry set = error/original 

Start all ever 

Return to call 



I checked that routine and it didn't seem to return any 
special value. Then after more code tracing, I found the 
only call to the above routine is in the form of 20 B6 18. 



Changing the JSR (20) to a LDA (AD) resulted in a 
deprotected copy. 

[XjMake a copy of both disks, ignoring errors on disk 
one. 

I 2 [ Edit the copy of disk one. 

Block Byte(s) From To 



$F4 $14F 



20 B6 18 



AD 



B6 



18 



I 3 [ Write the block back to the copy 
Softkey for... 



4th & Inches 

Accolade 



■ Requirements 

a Apple Ilgs 512K 
n 3 Vi " disk copier 
D 3>/2" disk editor 

4th & Inches (FI) is a football game alcmg the same 
lines as Hardball and Serve & Volley. You can control 
one team and play against the computer or a friend. The 
game has nice graphics and is alright. If you really like 
football, chances are you'll love FI. 

It looks like Accolade has switched to the standard 
nibble counting routine for protection. The protection 
routine is located on block $C5 of the disk and contained 
in the file START in the volume/SYSTEM subdirectory. 
The whole protection routine is as follows: 



El 



97:C2 30 
99:20 0179 
9C:E2 30 
9E:AD5DEB 
A1:D0 2B 
A3:EE5DEB 
A6:C2 30 
A8:A2 0102 
AB:22 00 00 
AF:B0 6D 
B1:F4 00 00 
B4:A2 02 02 
87:22 00 00 El 
BB:80 61 
BD:68 

BE:8D5FE8 
C1:AD5FEB 
C4:68 

C5:22C2E6 02 
C9:68 
CA:B0 52 
CC:E230 
CE:A2 20 
D0:A0 01 
D2:20 21EB 
D5:8E61EB 
D8:8C62EB 
DB:A2 21 
DD:A0 01 
DF:20 21EB 
E2:8E63EB 
E5:8C64EB 
E8:AD61EB 
EB:C9 00 
ED:AD62EB 
F0:E9 20 
F2:90 2A 
F4:AD63EB 
F7:C9 00 
F9:AD64E8 
FC:E9 1F 
FE:80 1E 
00:82 2D 00 
03:5A 
04: DA 

05:F4 02 00 
08:F4 56EB 
08:22 83 E7 02 
0F:8D5BEB 
12:68 
13:68 
14:68 
15:68 



REP 
JSR 
SEP 
LDA 



#30 

7901 

#30 

EB5D 
BNE CE (+28) 
INC E85D 
REP #30 
LDX #0201 
JSL E10000 
BCS HE (+6D) 
PEA 0000 
LDX #0202 
JSL E 10000 
BCS HE (+61) 
PLA 
STA 
LDA 
PLA 
JSL 
PLA 
BCS 
SEP 
LDX 
LDY 
JSR 



16bit wide Accum. 



8 bit wide Accum. 



16 bit wide Accum. 

MMBootlnit 

Tool locator call 

If error then bomb 

MMStartVp 

Tool locator call 

If error then bomb 



EB5F 
EB5F 

02E6C2 



HE (+52) 
#30 

m 
#01 

EB21 
STX EB61 
STY EB62 
LDX #21 
LDY #01 
JSR EB21 
STX EB63 
STY E864 
LDA EB61 
CMP #00 
LDA EB62 
SBC #20 
BCC HE (+2A) 
LDA E863 
CMP #00 
LDA EB64 
SBC #1F 
BCS HE (+1E) 
BRL 130 (+002D) 
PHY 
PHX 
PEA 
PEA 
JSL 
STA 
PLA 
PLA 
PLA 
PLA 



EB56 

02E783 

EB5B 



8bit.wide Accim: 

Track $20 

Side 

Jump to the nibble couiu 

Store half of result 

Store second half 

Track $21 

Side 

Jump to the nibble count 

Store half of result 

Store second half 

Load Track $20 result 

Check first half 

Oieck second half 

If error then bomb 

Load track $21 result 

Check first half 

Check second half 

If error then bomb 

Branch to continue code 

Push side 

Push track 

Push tSsk name/volume 

Count them up 

Store error flag 



# RiMter*lMtaEateiuuiiii t 



c<Migiitigi^#ft8 4 



16:68 


PLA 




17:68 


PLA 


Pull all extra values 


18:AD5BEB 


LDA EB5B 


Load error flag 


1B:B0 01 


BCS HE (+01) 


If error then bomb 


1D:60 


RTS 


Return to caller 


1E:C2 30 


REP #30 


16 bit wide Accum. 


20:A2 00 00 


LDX #0000 




23:A9DBDB 


LDA #DBDB 


Load2STP's 


26:90 00 00 


STA 0000, X 


Store them everywhere 


29:EB 


INX 




2A:EB 


INX 




2B:D0F9 


BNE 26 (-07) 




2D:4C4BEB 


J MP EB4B 


-= BOMB =- 


30:C2 30 


SEP #30 


8 bit wide Accum. 


32:20 5A78 


JSR 785A 




35:E2 30 


REP #30 


16 bit wide Accum. 


37:60 


RTS 


OKAY to run program! 


38;54 4F4E59 


TONY 


Disk name/volume 



Well that's most of the protection routine. After 
checking this code, I found the calls to it look like JSR 
EAB5 (20 B5 EA) on the disk. Searching for this sequence 
revealed two calls to the protection. After changing both 
JSR's (20) to LDA's (AD) , I booted the disk and the program 
ran just fine. 

I 1 [ Make a copy of the game disk. 

I 2 I Edit the copy disk. 

Block Byte(s) From To 



$72 
$9A 



$86 
$40 



20 B5 EA 
20 B5 EA 



AD B5 EA 
AD B5 EA 



Softkey for.. 



Jim Heil 



Spanish for Mastery Software 

D.C. Heath and Company. 



1 1 I Copy Master Disk using Super lOB changing the 
Address Epilog from DE AA to DE DE for reading. 

[T]Edit the copy. 

Trk Set Byte(s) From To 

$02 $03 $00 A0 4C 

$02 B9 98 

I 3 I Copy Both sides of the other disks and the back of 
the Master Disk with a normal copy routine. 

These sector edits stop the program from looking at 
track $23 for sync info. 



Edward Teach 



First, for all of you who thought that I was attacking 
Jack Nissel in COMPUTIST #61,1 wasn't. What I meant 
with the "38 softkeys" remark was that someone with that 
much ability should share their knowledge. And yes Jack, 
you are doing better. 

Second, I was contacted recendy about creating a virus 
for DOS 3.3 and ProDOS. An interesting question. I chose 
not to write back to the person, but instead will address 
my response here. If you think that a disk has a virus, there 
are a number of things that you can do. I usually boot the 
disk, then insert another disk in the drive, and catalog it. 
(I have a DOS that has had the "INIT" command 
removed). If that DOS is overwritten, then you have to 
wipe out the DOS from the original disk and place a new 
DOS on the disk. Boot it again, and catalog the second 
disk. If no changes occur then you MIGHT be safe. The 
virus could be located in a file. Next boot the original disk 
again and get to an Applesoft prompt. Type: 

10 FOR X=l TO 255: PRINT CHR$(4) "CLOSE":NEXT 

Then run this program. If the virus is tagged to DOS 
commands, hopefully it will bomb on one of the "close" 
statements. If it still does not show signs of a virus, try 
Locksmith v6.0, the compare function. Make a copy of 
the disk and boot the copy. Compare the original with the 
booted copy. If any differences show up, (they should not) 
kill the disk. The one final thing that I tO' is to write protect 
the disk and boot it. If I end up in the monitor it could 
mean that the disk was trying to write during booting 
(decrementing a counter?) and bombed out. I also wipe 
the disk in this situation. So, in answer to the persons' 



question, could I write a KILLER DOS? Probably, but 
I see no reason. The COMPUTIST is here to help people, 
let's leave the virus to the IBM hackers who don't know 
what else to do with their time. (I do admit that I wanted 
to work in something about ONE BAD APPLE spoiling 
the whole bunch). 



Softkey for.. 



MECC Copy Program 

MECC 



This is not your typical MECC disk. The MECC copy 
program will copy a normal disk, a MECC disk and also 
itself. It has a great RWTS, to be able to handle 3 different 
prologues. The header prolog was D5 AA FF, and the data 
prolog was D5 AA FE. The disk also had a nibble check. I 
have never seen a MECC disk with a nibble check. To 
deprotect this, we have to defeat the nibble check and put 
the disk back into normal format. Run SUPER lOB and 
enter the controller listed below, then sector edit the copy. 

Trk Set Byte(s) From To 



$00 $07 $8B FE 


AD 


$08 $2A FE 


AD 


$98 FF 


96 


$0B $B2 FF 


96 


$02 $00 $41-42 B0 68 


18 EA 


$48-49 B0 61 


18 EA 


$4F-50 B0A5 


18 EA 


$AB-AD 20 8D31 


EA EA EA 


$01 $8A-8C 4C AB 30 


EA EA EA 


$02 $23-25 4CAB30 


EA EA EA 





Controller 



I F PEEK (TRK) =LT THEN 1050 
PEEK (SCT) : GOTO 1020 
: MB =151: ONERR GOTO 550 

GOSUB190:GOSUB 



1000 REM MECC COPY CONTROLLER - 12/01/88 

1010TK = 0:LT = 1:ST = 15:LS = 15:CD = WR:FAST=1 

1020 GOSUB 490 :GOSUB 610 

1030 GOSUB 490 :60SUB 610: 

1040TK = PEEK(TRK):ST = I 

1050TK = 1:LT = 9:CD = WR:I 

1060 ST = : Tl = TK : GOSUB 490 : RESTORE 

210: GOSUB 170 
1070 GOSUB 430: GOSUB 100;ST = ST + 01 : IF ST < 16 THEN 

1030 
1080 IFBF THEN 1060 

1090 ST = 0:TK = TK + 01 : I F TK < LT THEN 1030 
1 100 GOSUB 230 : TK = Tl : ST = : GOSUB 490 
1110 GOSUB 430: GOSUB 100:ST = ST + 01 : IF ST < 16 THEN 

1070 
1120ST = 0:TK = TK + 01: IF BF = ANDTK< LTTHEN 1070 
1130 IF TK< LTTHEN 1020 
1140 HOME :A$ = "ALL' DONE" : GOSUB 450: END 
5000 DATA 213, 170, 255, 213, 170, 254, 222, 170, 222, 170 



Checksums 



1000 - $356B 
1010 - $EA41 
1020 - $3164 
1030 - $5E3F 
1040 - $3A08 
1050 - $7B99 



1060 - $9F1B 
1070 - $D582 
1080 - $EBED 
1090 - $8F02 
1100 - $5FD2 
1110 - $234F 



1120 - $CFA8 
1130 - $D1F1, 
1140 - $6B91 
5000 - $2CAF 



Brent Michalski 



I hope that this hack helps some people out. It is the 
first disk that I have successfully cracked and I thought 
that this one was very easy. I decided to break it because 
of the registration card that came with the program. I had 
paid $13 for the program and the card said I could have 
a backup for the low price of $10 (limit one). To me that 
is totally unacceptable. 



Softkey for.. 



The Game Show 

Advanced Ideas Inc. 



■ Requirements 

n 2 blank disks 

D COPYA 

n System Utilities (ProDOS 1.1.1 based) 

[T]Tell DOS to ignore errors and COPYA side 1 of the 
disk. 



POKE 47426.24 
RUN COPYA 

[2~| Format the other blank disk with the volume name 
"GAMESHOWOIGZMJ" using the ProDOS system 
utilities disk. When it asks whether you want ProDOS or 
DOS 3,3, choose ProDOS. 

[Tl Using the ProDOS system utilities disk again, choose 
"Copy Files" from the menu. 

[T]Use the COPYAed disk as your original and the 
formatted disk as the blank and copy ALL of the files. 

in Copy side 2 to a different disk, it isn't copy protected. 

That is all I had to do, the game played fine for me 
and I was even able to make as many backups as I wanted 
using only COPYA. I don't really know what kind of 
protection was used, but it was sure easy to overcome once 
I quit messing around with the JSR $C600 on track $00 
sector $0E. I guess it was just built into its own litfle 
version of ProDOS. 

Note: this disk contains the dreaded ProDOS 1.1.1, 
so you might want to patch it using Gerald E. Myers patch 
from COMPUTIST #59, Page 29. 

C5) Could anyone please tell me where I can get 
a copy of "Beneath Apple DOS" through the mail. The 
selection of books on base over here in England is really 
depressing. 

Thanks for being such a great magazine! 

* Order the book direct! See page 28, 1st column, 
2nd paragraph RDEXed 



Jose A. Montano 



After a rest and re-examination of my program, ' 'The 
Bard's Dressing Room HI" (TDR3), I discovered four 
bugs that should be corrected. With die exception of one, 
these bugs do not seriously affect the operation of the 
program, and two don't affect the operation at all. They 
are "cosmetic" bugs. 

1. A very embarrassing, though cosmetic, bug in the 
"Edit Spell Level" routine causes the question "Which 
Item?" to appear over the border instead of within the 
border. To fix it all tiiat is required is to replace "VTAB 
21" with "VTAB 22" at the beginning of line 4530. 

2. In the "List Available Items" routine a very nasty 
little bug will bomb die program if you try to F)orward 
the listing past the last screen of available items. To 
exterminate this one you must change "FI < 230" to "FI 
< 225" in line 3140. 

3. The "Drop Item" routine will drop the last item 
on the "Carried Items" list if you hit <RETURN> alone 
when it asks ' 'Which Item' ' . If you like it that way, leave 
it. If not, you must change line 2920 to read: 
2920PRINT "WHICH ITEM:";: INPUTCW$:CW=VAL (CW$): IF 

CW < OR CW > 12 OR CW$ = " " THEN 2950 

4. The last is a cosmetic bug in the "List Available 
Items" routine. The tiiird screen of items (beginning witii 
item #91) shows the second and third columns with a ' 'zig- 
zag" effect. Unfortunately this is the hardest one to fix 
because it requires the most typing. Line 3080 must be 
retyped to read: 

3080 PRINT SPC(X< 100) ;SPC(X< 10) ;X")"I$(X);TAB( 
27) ; SPC(( X+ 15) < 100) ;X+ 15") "l$(X+ 15) ; TAB( 
54) ; SPC(( X + 30) < 100) ;X + 30") " l$(X + 30) 

I'm really sorry for the inconvenience, but I hope you 
will use the program and let me know through 
COMPUTIST about any more bugs you might find. I am 
also interested in enhancements to modify different 
character attributes. Either make the changes yourself and 
tell us about it, or let me know what you would like and 
I'll make the changes and send them to COMPUTIST. 



Jack R. Nissel 



Softkey for... 



Reading Skills 2 

American Educational Computer 



CQMPtmgTjlfgS 



# y— ijwHi Date KX c h ai ifl t * 



This tide can be deprotected by using Super lOB with 
the Swap Controller. Use the RWTS of the protected disk 
to read die original disk then use a normal RWTS to write 
the information back to your blank disk. 



■ Requirements 

D DOS 3.3 

D A blank disk 

D SuperlOB vl.5 ' 

D A way to reset into the monitor ' 

I 1 [ Boot DOS 3.3, insert the blank disk, and initialize 
it to create a slave disk. 

INIT HELLO 
DELETE HELLO 

I 2 I Boot your original disk and at the Applesoft prompt, 
reset into the monitor. 

I 3 I Move the RWTS to a safe place, where it won't be 
destroyed when you boot your slave disk, by entering: 

1900<B800.BFFFM 

I 4 I Boot the slave disk. 
C600G 

I 5 [ After the disk boots and the Applesoft prompt 
appears, insert your Super lOB disk and save the RWTS 
to it. 

BSAVE RWTS.READING COMP SKILLS 2. 
A$1900, L$800 

I 6 I Install the controller into Super lOB, run it and copy 
your original disk to your blank disk. Answer "NO" when 
asked if you want to INITialize the blank disk. 

Controller 

1000 REM READING COMPREHENSION SKILLS 2 

1010TK = 3:ST = 0:LT = 35:CD = WR 

1020 Tl = TK: GOSUB 490: GOSUB 360: ONERR GOTO 550 

1030 GOSUB,430 : GOSUB 100 : ST = ST + 1 : I F ST <,DOS THEN 

1030 
1040 I FBF THEN 1060 

1050 ST = 0:TK = TK + 1 : I F TK < LT THgN 1030 
1 060 GOSUB 490 : TK = T 1 : ST = : GOSUB 360 
1070 GOSUB 430 : GOSUB 100 : ST^ = ST + 1 : IF ST < DOS THEN 

1070 
1080 ST = :TK = TK + 1 : IF BF = AND TK < LT THEN 1070 
1090 IFTK<LT THEN 1020 
1100 HOME : PRINT "COPY^DONE" : END 
10010 PRINT CHR$ (4) "BLOAD^RWTS. READ I NG'COMP'SK ILLS' 

2,'A$1900" 



Checksums 


1000 - $356B 1040 - $6342 1080 • 
1010 - $3565 1050 - $ABA3 1090 - 
1020 -$6170 1060~$20C0 1100.■ 
1030-$7771 1070-$28C5 10010- 


- $6CA2 

- $9DCA 

- $9A4D 
-$9CD3 


Softkeyfor... 


School Magic 

McCarthy-McConnick: , Inc. 



This title can be deprotected by using Super lOB with 
the Swap Controller. 
■ Requirements 

D DOS 3.3 

D A blank disk 

D SuperlOB vl.5 

D A way to reset into the monitor 

[T]Boot DOS 3.3. Insert the blank disk. 

miT HELLO 
DBUE1E HELLO 

I 2 I Boot your original disk and at the Applesoft prompt 
reset into the monitor. 

I 3 I Move the RWTS to a safe place, where it won't be 
destroyed when you boot your slave disk, by entering: 

1900<«00.BFFFM 

[Tl Insert the newly INTT'ed disk and boot it. 
C8O0G 

[TJ After the disk boots and the Applesoft pr<Mnpt 



appears, insert your Super lOB disk and save the RWTS 
to it. 

BSAVE RWTS.SCHOOL MAGIC,A$1900,L$800 

I 6 I Install the controller into Super lOB, run it, and copy 
your original disk to your blank disk. Answer "NO" when 
asked if you want to INITialize the blank disk. 



Controller 

1000 REM SCHOOL HAG I C CONTROLLER 

1010TK = 3:ST = 0:LT = 35:CD = WR 

1020 Tl = TK: GOSUB 490 : GOSUB 360 : ONERR GOTO 550 

1030 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS THEN 

1030 
1040 I FBF THEN 1060 

1050 ST = 0:TK = TK + 1 : IF TK < LT THEN 1030 
1060 GOSUB 490 : TK = Tl : ST = : GOSUB 360 
1070 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS THEN 

1070 
1080 ST = :TK = TK + 1 : I F BF = AND TK < LT THEN 1070 
1090 IFTK<LTTHEN1020 
1100 HOME : PRINT " YOUR' SOFTKEY'IS' DONE" : END 
10010PRINTCHR$ (4) "BLOAD'RWTS.SCHOOL'MAGIC,'A$1900" 

Checksums 



Softkey for.. 



1000 - $356B 
1010 - $3565 
1020 - $6170 
1030 - $7771 



1040 - $6342 
1050 - $ABA3 
1060 - $20C0 
1070 - $28C5 



1080 - $6CA2 

1090 - $9DCA 

1100 - $C54C 

10010 - $D082 



Addendum to the Softkey for.. 



Addition Logician 

Discovery Lab 

Elementary Volume 1 

Files on the Apple 

Friendly Computer 

Right of my 
Science Volume 1 
Science Volume 2 
Science Volume 3 
Science Volume 4 
Space Subtraction 
Special Needs Volume 2 

Sub^actionPuzsdes 

Word Herd: Look-Alikes 

Word Herd: Sound- Alikes 

Word Wizards 

MECC 



The MECC CMitroller in COMPUTIST #65, page 19, 
will also copy these titles. 

Softkey for... 



Monkey Business 

Learning Technologies 



■ Requirements 

D A blank disk 

D A sector editor 

D A fast copy program 

I used Jerry Suchar's softkey for Shutterbug in 
COMPUTIST #56, page 10, for this title. For an 
explanation, read his article. 

I 1 I Fast copy your original to your blank disk. 

I 2 I Make the following sector edits to your copy. 

Trk Set Bytc(s) From To 



$20$05$8A-8B 



D0D8 



60 EA 



I 3 [ Write the sector back to the disk. 



F.M.C. Program 

Continental Software 



■ Requirements 

D A blank disk 

D COPYA from your DOS 3.3 system disk 

The only thing we have to do, to deprotect this tide, 
is to make a copy with COPYA, after telling it to ignore 
checksums and the altered epilogues. 

I 1 [ Boot your DOS 3.3 system disk. 

I 2 [ Tell DOS to ignore checksum and epilog errors and 
use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 

Softkey for... 



Mindshadow 

Activision 



■ Requirements 

D 2 blank disks 
n A sector editor 
D Super lOB vl.5 

The softkey, by Wayne Williams, in COMPUTIST 
#47 did not completely deprotect my version. I searched 
through the sectors on track $00 to see if any additional 
sector edits should be done and I found an additional byte 
that needed to be changed for the address prologues. Here 
is what to do. 

I 1 [ Install the controller shown below into Super lOB, 
run it, and copy both sides of your original disk to your 
blank disks. 

I 2 I Make the following sector edits to the copy you made. 

Trk Set Byte(s) From To 



$00 $07 $2F-3E 


77 


all toAA 


$3F-4E 


77 


all to 96' 


$00 $0A $C5-D4 


1.1. 


alltoAA 


$D5-E4 


1.1. 


all to 96 


$01 $FB-FD 


D9 2F BA 


C9 DE EA 


$02 $06-08 


D9 3F BA 


C9AAEA 


$0C$5B-5D 


D9 C5 F3 


C9 DE EA' 


$66-68 


D9 D5 F3 


C9AAEA 



I 3 [ Write each sector back to the disk before going to 
the next edit. 



Controller ^ 

1000 REM MINDSHADOW CONTROLLER 

1010 TK = 0:LT = 35:ST = 15:LS = 15:CD = WR:FAST = 1 

1020 GOSUB 490: POKE 47507,0: POKE47517,0:MB = 55: IF 

TK > THEN GOSUB 190 
1030GOSUB610:MB = MB + 16:TK = TK + 1: IFTK=17 0RTK 

= 33 THEN RESTORE 
1040 IF MB < 152 THEN G0SUB190: GOTO 1030 
1050 GOSUB 230: POKE 47 507, 174: POKE 47517, 164:TK = TK 

-7:MB = 151 
1060 GOSUB 490 : GOSUB 610 : I F PEEK (TRK) ^ LT THEN 1080 
1070 TK = PEEK (TRK) : ST = PEEK (SCT) : GOTO 1020 
1080 HOME : PRINT "NOW'ON'TO'THE'SECTOR'EDITS" : END 
5000 REM NO CHANGE ON TRACK 
5010 DATA 213, 151,238 
5020 DATA 213, 154,239 
5030 DATA 213,155,242 
5040 DATA 213,157,243 
5050 DATA 213, 158,244 
5060 DATA 213, 159, 255 
5070 DATA 213, 166,247 
5080 DATA 213,237, 150 
5090 DATA 213,238, 166 
5100 DATA 213,239, 170 
5110 DATA 213,242,213 
5120 DATA 213,243,223 
5130 DATA 213,244,234 
5140 DATA 213,245, 174 
5150 DATA 213,246,254 



-h- 



Unto 



,ciommwmif9i6 



5160 DATA 213, 150,237 



Chiscksums 



1000 - $3568 
1010 - $2544 
1020 - $F402 
1030 - $D637 
1040 - $2181 
1050 - $3DED 
1060 - $9769 
1070 - $742A 
1080 - $5BE5 



5000 - $1463 
5010 - $AB61 
5020 - $4739 
5030 - $15E9 
5040 - $CFDE 
5050 - $82EB 
5060 - $8CE7 
5070 - $1799 
5080 - $3710 



5090 - $E2A4 
5100 - $496E 
5110 - $14FA 
5120 - $0B7E 
5130 - $6FEB 
5140 - $3CF7 
5150 - $6D2F 
5160 - $0E5D 



Addendum to the Softkey for.. 



ZoyoD Patrol 

MECC 



■ Requirements 

D 2 blank disks 

D COPYA from your DOS 3.3 system master 

n A sector editor 

The softkey in COMPUTIST #53 by Dudley Brett was 
not complete, 4 additional sector edits have to be made. 
Here is the complete softkey. 

on Boot your DOS 3.3 system master. 



CALL-151 

B8F3:00 

B8FE:00 

B92S:18 60 

3D0G 

RUN COPYA 



enter the monitor 

ignore 2nd data header byte 

ignores 3rd data header byte 

ignores data trailer 

back to applesoft 



I 2 I Copy both sides of the original to your blank disks. 
I 3 I Make the following sector edits to side 1 of your copy. 

Trk Set Byte(s) From To 

$00 $0B $99 AD AA 

$00$0B$A3 AA AD 

$00 $0C $82 AD AA 

$00 $0C $87 AA AD 

$02 $01 $51-52 ADAA AAAD 

(if you find that these 2 seaors were AA-AD originally, ignore tins step). 

$02 $01 $57-58 ADAA AAAD 

I 4 [Write each sector back to the disk before going to 
the next one. 

Softkey for... 



Adventure Double Feature Vol II 
Mystery Double Feature Vol I 



Scholastic 



■ Requirements 

n 2 blank disks for each title 

n Copy II Plus 

D FID from your DOS 3.3 system master 

n~l Boot a DOS 3.3 disk. Insert a blank disk in the drive. 

INIT HELLO 
DELETE HELLO 

I 2 I Use FID to copy all of the files from both sides of 
the original to a blank disk. 

POKE 47426,24 disable error checking 

BRUNFID 

I 3 [ Boot the Copy II Plus sector editor. When you are 
in the sector editor, press P for Patch Read/Write Routines, 
select DOS 3.3 PATCHED, press Retain, then Esc. Read 
track $00, sector $00 from side 2 of the original disk. 

[T] Press P for Patch Read/Write Routines, select DOS 
3.3, press Return then Esc. Put in side 2 of your copy and 
write the sector back to the disk. 

I 5 I We must remove the remaining part of the protection. 
Boot your DOS 3.3 system master, then insert side 1 of 
your copy. 

LOADHILLO 



SAVE HELLO 

LOAD HELL02 



SAVE HELL02 

LOAD HELL03 



SAVE HELL03 

Note: On one of my copies there was only HELLO 
and HELL02, so if you get a "FILE NOT FOUND" 
message skip that file. 

You can put Diversi-DOS on side one if you want to 
speed up your loading. Your disk is now in normal format 
except that the screen that says "Scholastic Wizware" 
when you first boot your original will not appear on your 
copies. To fix this see the end of the next softkey. 

Softkey for... 



LOGO Robot 
Poster 

Scholastic 



■ Requirements 

D A blank disks for each title 

n Copy II Plus 

D FID from your DOS 3.3 system master 

I 1 [ Boot your DOS 3.3 system master. Insert a blank disk 
in the drive. 

INIT HELLO 
DELETE HELLO 

I 2 I Use FID to copy all of the files from your original 
to your blank disk. 

POKE 47426,24 (tiscAle error checking 

BRUNFm 

I 3 I Now remove the remaining part of the protection. 
Boot your DOS 3.3 system master, then put in side 1 of 
your copy. 

LOAD HELLO 


SAVE HELLO 

LOAD HELL02 



SAVE HELL02 

LOAD HELL03 



SAVE HELL03 

That's it, your disk is now in normal format except 
that the scrMflia*^%#»'S*tiia^ie%teware'' when you 
first boot your original will not appear on your copies. 

You can put Diversi-DOS on if you want to speed up 
your loading. 

Getting the Title page 

Here's how to get the 4 Scholastic titles shown above 
to load the title page that says "Scholastic Wizware". 

Check all of your deprotected Scholastic disks, 
including the 4 titles shown here, for a binary file called 
PIC. WIZWARE, (I found it on one of these titles plus on 
another Scholastic disk). If you have this file, copy it onto 
Logo Robot, Poster and side 1 of Adventure Double 
Feature and Mystery Double Feature. Boot your DOS 3.3 
system master, then insert the appropriate title in your 
drive. 

LOAD HELLO 

6 HOME 

7 PRINT CHR$(4) "BLOAD PIC.WIZWARE, A$2000" 

8 POKE -16302,0: POKE -16297,0: POKE -16304,0 

9 POKE 16384,0: POKE 103,1: POKE 104,64 
SAVE HELLO 

If you cannot find the PIC.WIZWARE file, then it 
gets trickier. 

I 1 [Boot your DOS 3.3 system master. 

CALL-151 gets you into the monitor 

800:00 clears memory at 800 

801<800.95FFM clears memory frm 800 through 9SFF 

I 2 [ Put your original disk in the drive. 



COMPUTIST <W6 



C600G boots slot 6 

I 3 [ As soon as the "Scholastic Wizware" page comes 
up, break into the monitor and search to see where the 
picture is loaded. It probably starts at $2000. Once you 
find the start of the file, continue looking through memory 
until you see where the file ends. If all of the file is in 
a location in memory where it will not be trashed by a 
reboot, put in a normal DOS 3.3 disk with a deleted 
HELLO program and boot the disk. 

C600G 

I 4 I Then BS AVE the file to disk with the starting address 
and the file length. 

BSAVE PIC.WIZWARE, A$?7?7, L$???? 

I 5 I Now do what I said to do if you found a disk with 
the file already on it. 

I 6 I If the file is in a location in memory that will be 
trashed by a reboot then you will have to move it to a safe 
place in memory, boot the DOS disk, get into the monitor, 
move the file back to it's original place in memory, get 
back to Applesoft and then BSAVE it as shown above. 
Am I doing better, Ed? 



Rich Linville 



I use Apple Ilgs's in the classroom and have found 
two hardware problems: 

Holding down the Option key while turning on the 
computer shows a menu that allows you to enter the 
Control Panel. If a faulty joystick is plugged into the 
computer, the screen will lock up at the Control Panel 
menu because one of the fire buttons on the joystick is 
the same as the Option key. Once you figure out that the 
joystick if your problem, simply unplug it and restart. 

When the Ilgs doesn't respond to typing, unplug the 
cable from the keyboard and plug it in where the mouse 
was connected. If you are now able to type, the fault could 
be inside the keyboard. Flexing at this connection causes 
the soldering to crack. Have someone who knows how 
to solder electronic equipment remove the 3 screws on the 
bottom of the keyboard and resolder the cracked 
connections on the green board inside. 

(2) I would like to learn how to deprotect the 
latest two-sided "Oregon Trail" from MECC and put it 
onto a 3 1/2" disk. Also, could someone include a routine 
for this program that will save unfinished games on the 
disk, because there isn't always enough time in class to 
finish the adventure. Many of my students would be 
grateful. 

.<2>:l5 there any, , way to fix "Th? Seven Cities 
of Gold" by Electronic Arts so that you can move by the 
keyboard arrows instead of just the joystick? 

O) Even if I can only put one DOS 3.3 program 
from a 514" onto a SVi" disk for the Ilgs, what are the 
best ways to accomplish it, if possible? 



Bud Myers 



To Warwick Phillips: The Print Shop saves images 
as 4-sector binary files in DOS 3.3 format. Publish It! will 
load only standard Apple hi-res screens from a ProDOS 
disk. To use Print Shop graphics, for instance, you need 
to collect eight or nine of them into a single screen image. 
Clipcapture, Print Shop Lover's Utility Disk, and others 
will allow you to do this. Next, use the ProDOS Utility 
disk or Copy II Plus to convert the files to ProDOS. Then 
load them into Publish It! and print them. 

One further complication: Publish It! insists that its 
screen files be 34 sectors in length; some programs save 
them in 33 sectors. An article by Roberta Schwartz and 
Michael Callery, "Speaking of Graphics", in the 
December issue of A+ magazine, explains how to convert 
one to the other. 

Florida PC Library, PO Box 2878, Leesburg, FL 
32748, has five disks of Publish It! fonts at extremely 
reasonable prices (I forget exactiy how much, but aU five 
are less than a single font disk from Turning Point). They 
are Disks H60 through H64. 

To aH: The MECC copying system, which comes with 
a site license from MECC, is an excellent way to copy 
ALL their disks as well as any other unprotected disks. 
It makes Use of all auxiliary memory in your Aj^le and 



#"lto aiiaf »'P[rt«'gXdhiia>a« # 



where possible loads the entire disk contents into menjiory, 
thus allowing you to use both drives as destination drives, 
and speeding up the copy process considerably. 

<2) If anyone has been able to use Print Magic 
graphics with Publish It!, please share the method: 



A. Evans 



(2) How about a softkey for Frogger & Pirates! 
that doesn't require an NMI card? 

A.P.T.for... 



Pirates! 

MicroProse 



■ Requirements 

D ProDOS 

□ Pirates! Save disk 

This APT is in response to Jason Cobb's request in 
COMPUTIST #62 and also to anyone tired of sailing 
against the wind from town to town. The following 
locations were discovered after BLOADing any one of the 
four SAVE.GAMEs (A$800, L$700). There is a four step 
process to use the data. 

|T]Boot into ProDOS. 

ITlLoad one of the four SAVE.GAMEs. 

BLOAD SAVE.GAMEx (x = 1-4) 

I 3 I Edit appropriate locations. 
[T]Save the SAVE.GAMEx file. 
BSAVE SAVE.GAMEx, A$800, L$700 

Town Info 

There are 36 towns used in each game, but the names 
of towns will vary based on the scenario being played 
(certain year or famous expedition). The alphabetic list 
of towns starts at $900, each town uses 24 bytes of 
information: 

Location 





$900-917 = town 1 




$918-92F = town 2 




etc. = etc. 




$C48-C5F = town 36 


Byte# 


1-3 


? 


4 


Ruling country: = Spanish, 1 = english, 2 




= french, 3 = dutch 


5 


# of forts: (0 - 15) 


6 


# of soldiers (divided by 10) 


7 


# of citizens (divided by 100, minus 1) 


8 


gold (divided by 1000) 


9-12 


? 


13-24 


name of town 



Player Info 

I could not determine which bytes contained player 
age, health, and starting skills (fencing, navigation, 
gunnery, wit & charm, medicine), but I did recognize the 
following locations: 

$E02-E03 personal gold (divided by 10)* 

$E05 acres of land (divided by 50) 

$E06 tt of rescued relatives 

$E07 mood of crew (the lower the value, the 

better) 

$E0D Spanish status 

$E0E english status 

$E0F french status 

$E10 dutch status 

1 - ensign, 2- captain, 3 -major, 4- 
colonel , 5 - admi ral , 6 - baron, 7 - 
count, 8 -marquis, 9 -duke 

$E14 spouse status 

- single, 1 - shrewish & pestersome, 2 - 
friendly Sattractive, 3- lovelyfi 
cheerful , 4- exciting & beautiful 

$EI9 present town (1. .36) minus 1 

$E1A year? 

$E1D in pursuit of: 0-Vasquez, I -Delgado, 2 





-Alvarado, 3 - Mendoza 


$E23 


# of crew 


$E25 


#of cannon 


$E27-E28 


expedition gold (divided by 10)* 


$E29 


tons of food 


$E2A 


tons of goods 


$E2B 


tons of sugar or tobacco 


$E2F 


#of ships (1..8) 


$E34 


ship 1 


$E35 


ship2 



$E3B ship 8 

0- pinnace, I -sloop, 2 -barque, 3- 
cargo f luyt, 4 -merchantman, 5 - 
frigate, 6 -war gal leon, 7 - gal leon 
(damaged ships are ship # times 16) 

$E50-E58 your character name 

* value = Hi byte x 256 -I- Lo byte. 



Gary Verbuch 



Now that I finally have a little time, I'd like to make 
a few comments and suggestions that could be kicked 
around by the editor and readers. 

After paging thru about six issues of Computist, there 
are always quite a few questions concerning various 
subjects that probably take months to be answered, if ever. 
One of the most important services a magazine can offer 
is answering technical questions, whether they be hardware 
or software. If a few of the current subscribers would agree 
to offer their name as a reference for one or more specific 
subjects, questions asked could be directed to an individual 
by the editor. Quite often, I am asked questions about the 
Apple, where the answers are hard to come by (hardware 
or software), especially where the Ilgs is concerned. For 
example, here are a few questions I was asked during the 
past week from Computist subscribers. 

Since the length of the answers were relatively long, 
I did not include the schematics and example code. If there 
are any questions concerning any of the below topics 
covered contact me through Computist 
Q. Why does Softswitch use the BBR (Battery Backed 
Ram) and what is the BBR used for. 

S Note: I have heard that Softswitch no longer uses the BBR 

for protection RDEXed 

A. First, I'd like to mention that this question was sparked 
by Brian Troha's article about Softswitch in COMPUTIST 
#61 and while I'm on the subject, I have to admit I am 
surprised Roger Wagner would allow a protection of this 
nature to be used on one of his products. I agree with Brian 
regarding tampering with an area of memory that critical. 
The reason Softswitch uses the BBR is strictly for disk 
protection. The byte changed in the BBR is not required 
by the application to run properly, only to verify the disk. 
Apple Inc. explicitly warns against using this block of 
memory for anything other than what it was originally 
designed for. Disk protection was definitely not an 
exception. 

To further describe the BBR, the buffer (256 bytes) 
is physically part of the RTC chip (Real Time Clock) and 
is reserved for the GS Control Panel, ProDOS 16 and 
Appletalk. For obvious reasons, any change to this block 
can cause serious if not fatal system errors. 

Because the BBR is contained on the clock chip it 
cannot be addressed in a normal fashion. Data must be 
read or written serially to or from the clock one byte at 
a time. Over one half of the BBR is reserved by the system. 

At bootup, the GS checks the BBR's checksum. I spent 
quite some time figuring out the protocol at this point 
because there was no mention in any of the GS reference 
manuals that the BBR is read into bank $E1/ ($2C0-$3BF) 
when verifying the checksum. The Tools to address the 
BBR are in the Miscellaneous ToolSet. 
Q. I've configured a LAN (Local Area Network) using 
Fiber Optics but the data integrity at the receiver end is 
inconsistent. 

A. After studying the schematic, the problem appears to 
lie with the power supply being common to the receiver 
and transmitter. One characteristic of the transmitter is 
it will generate glitches on the power bus (Vcc) during 
switching periods. This will inevitably cause false signals 
at the receiver end. To avoid the false signals, a separate 
power supply is necessary. Fortunately, the receiver 
requires only .5 amps, which can easily be supplied with 
a 9 volt battery and a few discrete components. 



If a reader would like a schematic of the above 
mentioned LAN, I would be glad to forward it. The 
protocol can easily be configured as a standard RS-232C 
instead of a 20 ma. current loop. The Fiber Optic 
transmitter and receiver uses digital encoding and is TTL 
compatible. The LAN cm also be configured without Fiber 
Optic transmission and achieve transmission rates of up 
to 9600 Baud at distances up to 1500 feet. 
Q. Can you have more than 15 voices when using the 
Ensoniq chip? 

A. The answer to this question is yes, but your 
programming experience will determine whether you want 
to attack the problem. There are thirty-two separate 
oscillators available on the DOC (Digital Oscillator Chip). 
Each oscillator is capable of generating a separate 
waveform. The problem lies with the GS firmware. The 
Sound Tools pair the oscillators together resulting in 15 
voices. Why not 16 voices if there are 32 oscillators?. 
Good question. The Sound Tools utilize the last pair of 
oscillators to generate time slice interrupts. The only 
options available to the programmer at this point are to 
develop your own code to interact with the DOC through 
the GLU (General Logic Unit) to utilize all 32 oscillators. 
Easier said than done. If your experience is limited with 
this type of device, then the Sound Tools are probably your 
best option. The majority of the housekeeping required 
to interact with the DOC is dealt with by the GS firmware. 

The register responsible for determining how many 
oscillators are active at any given time is the Oscillator 
Enable register ($E1), which is normally addressed 
through the Sound Tools. Simply multiply the number of 
oscillators you want active (0-31) by 2 and place the result 
in the Enable register. 

Quite often the questions brought to my attention are 
concerning the Ensoniq Chip in the Ilgs. I've noticed there 
is never any mention of this device in Computist and it's 
actually a hackers dream. In many ways 1 consider it more 
sophisticated than any device used in any Apple II series 
computers, including the microprocessor. The point I'm 
trying to make is, I feel Computist would invite new 
subscribers with experience in software and hardware if 
the magazine was not enveloped in software deprotection. 
Although deprotection would stay the theme of the 
magazine, other topics should be covered in depth. The 
result would be quite a few more subscribers and a more 
stimulating magazine for experienced programers, as well 
as beginners. 

I will gladly offer any help I may . My experience 
with writing 6502 code dates back to 1977 and I have been 
an active Engineer since 1978. With some of the other 
subscribers volunteering their help, I believe the columns 
would become an important addition to Computist. 

S That's a great idea and I'm all for it. Now, all we have 
to do Is convince other readers to start writing about something 
other than deprotection. How about it readers, got any other 
subjects you'd like to talk about? RDEXed 

Compiler Help Needed 

I was introduced to LISP about 12 years ago and there 
are now versions for just about every micro except the 
Apple II series computers. Since there is no other way to 
duplicate the power of Lisp, I decided to write my own 
version. Tiny Lisp. Naming it, was without question, the 
easiest part of this endeavor. 

To complete this project in the very near ftiture, I need 
at least one other programmers help. Part of the coding 
is completed. 

To keep a block structure, variable definitions will 
be lexically scoped. In keeping with other Lisp standards, 
cons space will contain pointers for linked lists and atom 
space will contain data values that can be organized into 
lists. 

The interpreter ftinctions (generally cons space) are 
completed and I've just about completed the Editor. With 
a littie help, I would also like to add the ability to evaluate 
expressions to the Editor, although it is not a priority at 
this point. 

AH of the parsing logic is completed on paper, now 
all I need is some assistance coding the compiler ftinctions. 
As far as a debugging utility, I have not touched it yet. 
There are quite a few other subjects that would have to 
be discussed. Free time to devote to this project is the 
biggest problem and with one individual helping, it could 
be completed in a matter of a few of months. 
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If you have compiler experience but you are not too 
familiar with Lisp, your coding experience is still needed. 

Here are a few programs I was recently asked to 
deprotect; 

Softkey for... 



Mastery Arithemetic Games 

Mastery Developement 



■ Requirements 

a DOS 3.3 
n COPYA 
n Blank Disk 

Mastery Arithemetic is an excellent introductory math 
package for children. The graphics and animation 
sequences enhance the clear and concise examples 
covered. 

The protection on this disk is a simple format alteration 
where the address prolog alternates between D5 AA 96 and 
D4 AA 96 and invalid data checksums are used. 

Use COPYA with some patches to RWTS to copy the 
disk. 



RUN COPYA 

ac 

POKE 47426,24 
POKE 47444,41 
POKE 47445,0 
70 
RUN 

Softkey for.. 



ignore checksum errors 
ignore Ist addr prolog byte 

Delete line 70 
Restart the program 



Algebra 1 
Algebra 2 

Edu-Ware 



■ Requirements 

D Starter Kit (Super lOB) or FID 
n Blank Disk 

The fundamental concepts of Algebra are divided into 
modules and covered in depth. I recommend either 
program as an excellent tutor for a student learning 
Algebra. 

Again the protection consists of format alterations and 
checksum errors. The address epilog is DA AA instead of 
DEAA. 

[TlBoot the Starter Kit disk and get into BASIC. 

POKE 47426,24 ignore epilog & checksum errors ' 

INIT EDU-WARE Init the blank disk 

I 2 [ Load Super lOB and merge the fast controller. 
Change TK in line 1010 to 3 instead of and start the 
program. 

LOAD SUPER lOB 

EXEC FAST.CON 

1010 TK = 3: LT = 35: ST=15: LS = 15: CD^WR: FAST^l 

RUN 

In step 2, FID can be used to transfer the files if you 
prefer not to use Super lOB. 

Softkey for... 



Sargon III 

Hayden Software 



■ Requirements 

□ Any Copier 
D Blank Disk 

As far as chess programs go, Sargon III is probably 
one of the best chess programs available for the Apple. 
Unfortunately, it is protected and I must admit I was kind 
of surprised when the parms for the popular Bit Copiers 
would not work for this version. Possibly it's a newer 
release, so I decided to deprotect it. I don't usually have 
the time to deprotect software anymore and I was hoping 
this would at least be a challenge. The last Apple product 
I found somewhat challenging was Flight Simulator II. 

While describing the deprotection process to a friend 
he wrote everything down to send to Computist. My 



version of the process consists of a couple of sentences 
but maybe the longer version might help some of the 
readers. 

The Search 

First things first, lets maktf a copy to work with. Any 
fast copier will do at this point, and if there are any format 
alterations, they will show up during the copying process. 

Okay, the format is not altered and the disk copied 
without a problem. Now boot the copy to get some idea 
of what and where the protection is. First, a prompt 
appeared during the boot, so we can assume somewhat 
of a standard DOS. Second, the disk check appears to be 
quite some time after the boot, so a Boot code trace is not 
a good approach. 

I decided to start with a normal DOS 3.3 environment 
and tried cataloging the disk. Approximately 40 files show 
up in the directory including a binary HELLO. To insure 
the Hello file is in fact the first file BRUN by DOS, I 
renamed it to "H" and rebooted the copy. "File not 
found" appeared, so, lets BLOAD the HELLO file and 
see what the code looks like. First, get into the monitor 
and find the load address. 

BLOAD HELLO 
CALL -151 
AA72.AA73 

This is the load address of the last BLOADed file (in 
lo-byte, hi-byte order). Now type the load address and an 
"L" to list the code. Here's what I found. 



needed later for return 
thru $FA62 



1000 LDA #$C0 

STA $03F2 

LDA #$13 

STA $03F3 

EOR #$A5 

STA $03F4 

JMP $1638 

This code sets the reset vector to point to $13C0 and 
jumps to $1638. Nothing unusual, so lets continue at 
$1638. 



Put the return address 

for the RTS on the stack 

set pointers 

for indirect 

addressing to 

EOR next stage 



1638 LDA #$15 


PHA 


LDA #$F5 


PHA 


1648 LDA #$56 


STA $08 


LDA #$11 


STA $09 


LDA #$96 


PHA 


LDY #$00 


1655 PLA 


EOR ($08), Y 


STA ($08), Y 


PHA 


DEY 


BNE $1655 


INC $09 


LDA $09 


CMP #$15 


BNE $1655 



actual EOR of 
next stage 



After the code is EOR'd, the return address is pulled 
of the stack and execution resumes at $15F6. If you are 
not sure what is on the stack for an RTS, the following 
bit of code will pull the stack twice for you and place the 
return address at $300; 



68 

8D 00 03 

68 

8D 01 03 

4C 59 FF 



PLA 

STA $300 
PLA 
STA 
JMP 



$301 
$FF59 



To see the results of the code being EOR'd type the 
following, 

167D:0 N 1638G 

This will run the code that EOR's the next stage and 
break execution before continuing to $15F6. 

Now, continuing on to $15F6 is where we find the 
calls to the signature check. Again, another address is 
stuffed on the stack ($FA61). Since the protection consists 
of over 5(X) bytes of code, I will not include all of it. 

15FC JSR $1570 position head thru RWTS 

15FF LDA $C0EA seka drivel 



turn drive off 



zero out memory 



lekXok $C0E9 turn drive on 

1605 LDA #$AB set comparison table 

mi STA $1562 for nibbles read 

16^A LDA #$AF frmdisk 

160C STA $1561 

160F JSR $159A read signature off disk 

1617 JSR $1570 position head 

161A LDA $C0E9 drive on 

161D LDA #$04 modify branch in signature 

161F StA $15D4 check to branch to $15W 

I'm including this memory wipe routine because 
similar routines are often used and can be a real headache 
when deprotecting software. 

15D9 PLA 

PLA 

PLA 

PLA 

LDA $C0E8 

SEI 

LDA #$00 

TAX 
15E4 STA $15F6,X 
15E7 I NX 
15E8 BNE $15E4 
15EA STA $14E4,X 
15ED DEX 

BNE $15EA 

DEC $15EC 

JMP $15EA 

The $04 placed at $15D4 alters the branch to a 
memory wipe at $15D9. If the proper nibbles are found 
on the disk, the branch at $15D4 is bypassed and execution 
resumes thru $FA62. If the vectors don't point at $13C0 
then the system does a warm start to BASIC. ($13C0 was 
stuffed in the reset vectors at $1(XX)). 

At this point, it's time to decide what code is needed 
for the program to load properly. NOPing out a few areas 
of code around $15F6 will produce a working copy. The 
code there is only used to check for the origind disk. 

The Crack 

I 1 I Make a copy of the original with any copier. 

I 2 I Boot the copy and hit S Reset when the prompt 
appears. 

I 3 I Load the Hello file and enter the monitor. 

BLOAD HELLO 
CALL -151 

[Tl Enter the patch and run the code at $1638. This will 
generate the code we need to load the rest of the program. 

1000:4C CO 13 

167D:0 

1638G 

I 5 I Save the EOR'd code as the new Hello file. 
BSAVE HEUO, A$1000, L600 

Put the original away. 



Bill Jetzer 



Displaying Hi Res and 
Double Hi Res Pictures from BASIC 



To Andy Home's question (COMPUTIST #62) about 
how to display DHR pictures from BASIC. 

It is easier to display HR pictures, so I'll cover that 
first. Here is the HR slide show program. It works under 
both DOS 3.3 and ProDOS and requires only 48K of 
memory: 

10 TEXT ; HOME : PRINTCHR$ (21):A = 8192: ONERRGOTO50 

20 READ F$: PRINT CHR$ (4) "BLOAD" F$ " ,A" A 

30 POKE 49234 , : POKE 49239 , : POKE 49232 , : POKE 49236 

+ 1 * (A>8192),0 
40 A = 8192 + 8192 * (A = 8192) : GOTO 20 
50POKE49168,0: WAIT 49152, 128: GET A$: HOME : TEXT : 

END 
60 DATA P I CTURE 1 , P I CTURE2 , P I CTURE3 , ETC 
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Checksums 



10 - $6BE8 
20 - $BBF7 



30 - $D812 
40 - $AE95 



50 - $90A3 
60 - $F393 



Line 10 clears the text screen and initializes the 
variable A to 8192, which is the BLOAD address for page 
1 . It also sets ONERR to go to line 50 after the last picture 
is loaded. 

Line 20 loads the next picture onto either page 1 or 
page 2, depending upon the value of A. 

Line 30 turns on 1) full screen, 2) HR, 3) graphics, 
4) the correct HR page. 

Line 40 toggles A between 8192 (page 1) and 16384 
(page 2) and loops back to line 20. 

Line 50 waits for a keypress while the last picture is 
displayed and then exits to BASIC. 

Line 60 is the data line. Put the names of your pictures 
here. 

DHR pictures (stored in Dazzle Draw format) are a 
little more difficult to display. If you have any important 
data stored in the /RAM disk, you must save it to disk 
so as not to destroy it. 

When you BLOAD a DHR picture, it is loaded at 
$2000 and goes up to $5FFF in memory. To display the 
picture, main HR page 1 must be moved to aux page 1 
and main page 2 must be moved to main page 1. With 
80 column firmware active, the enhancer at $C05E, which 
allows DHR to be displayed, must be switched on. To 
display page 2, main page 1 must be moved to aux page 
2 and main page 2 is left where it is. While displaying 
page 2, it is important that nothing is printed to the screen, 
even the cursor during a GET. For this reason a WAIT 
must be used to get a keypress. 

Here is the DHR slide show program. It works only 
under ProDOS and requires 128K of memory: 



DHR Slide Show program 

10TEXT : HOME : PRINT CHR$ (21) :B = 769:E = 775:A=8192' 
ONERR GOTO 80 

20 FOR X = 768 TO 790: READ Y: POKE X,Y: NEXT : DATA ' 
160,32,132,61,132,67,160,63,132,63,160,255,1 
32,62,200,132,60,132,66,56,76,17,195 

30 READ F$ : PR I NT CHR$ (4) "BLOAD" F$ " , A" A " , L$2000" 

40 POKE 8,32 + 32* (A > 8192): POKE E, 63 + 32* (A > 8192): 

CALL 768 
50 PRINT CHR$ (4) "BLOAD" F$ ",B$2000,A" A 
60 POKE 49234,0: POKE 49239,0: POKE 49246,0: POKE 

49165,0: POKE49232,0:POKE49236 + 1* (A > 8192), 
70 A = 8192 + 8192 * (A = 8192) : GOTO 30 
80 POKE 49168,0: WAIT 49152,128: POKE 49247,0: POKE 

49164,0: GET A$: TEXT: END 
90 DATA P I CTURE 1 , P I CTURE2 , P I CTURE3 , ETC 

_^ Checksums 



10 - $9E31 
20 - $5A21 
30 - $117D 



40 - $655A 
50 - $E04B 
60 - $BDFE 



70 - $CE5C 
80 - $6E5D 
90 - $975E 



Line 10 clears the text screen and initializes the 
variables B and E for the AUXMOVE routine. A is set 
to 8192, and ONERR is set to line 80. 

Line 20 pokes in the AUXMOVE routine. 

Line 30 loads the first half of the next picture into 
memory. 

Line 40 moves the first half of the picture into aux 
memory. 

Line 50 loads the second half of the picture. 

Line 60 turns on 1) full screen, 2) HR, 3) enhancer, 
4) 80 columns, 5) graphics 6) the correct HR page. 

Line 70 toggles A between 8192 and 16384 and loops 
back to line 40. 

Line 80 WAITs for a keypress while the last picture 
is being displayed, and then exits to BASIC. 

Line 90 is the data line. Put the names of your pictures 
here. Have fun with them. 

To George Sabeh: Some books that I use quite 
frequendy are the "Apple H Refeience Manual" and 
"About Your Enhanced Apple He: Programmer's Guide. " 
Both of these contain F800 ROM listings, and the enhanced 
He manual also contains $C100-$CFFF ROM listings. 
"The DOS Manual" contains a detailed example on how 



to use the RWTS, and much information about the VTOC 
and the way files are stored on disk. "Beneath Apple 
DOS" and "Beneath Apple ProDOS" contain much 
information about diskette format and using the disk drives 
independent of DOS and ProDOS in addition to just about 
everything you ever wanted to know about DOS or 
ProDOS. 

To Scott F. Earnest: the Merlin Pro assembler comes 
with a program called SOURCEROR.FP that disassembles 
Applesoft. It works by scanning the resident copy of 
Applesoft present in your computer, so it works with the 
Apple II, II+-, He, and lie. If you have a Laser, you're 
probably out of luck. It will print out 105 pages (including 
the symbol tables) of Applesoft, complete with comments, 
in about an hour and a half (at 80 cps). You might use 
an entire printer ribbon, but it won't cost you $50. 
However, Merlin Pro will cost you about $80. But if you 
are in the market for an assembler, and you won't find 
too many that are better than Merlin Pro, it would 
definitely be worth the price. 



Kay Jun 



I would like to thank all of the writers of softkeys 

for the softkeys you have been sending to COMPUTIST. 
Jack Nissel and Edward Teach, I've become your fan!. 
I've learned so much from reading COMPUTIST. 

I work with and teach programming, word processing, 
and data processing on IBM, Radio Shack(dinasours), and 
Apple computers, all at the same time! How about that 
for a headache? Needless to say, I now have COMPUTIST 
helping to cure my headaches. 

I spend thousands of dollars on software each year. 
In some cases I have purchased software packages for 
$12(X) and then found out I must spend another $275 
dollars for backups . In the past, I have been forced (most 
of the time) to allow 6-13 year old students to use original 
disks! Until I found COMPUTIST, I gritted my teeth and 
cried on many occasions. 

Edward Croft Jr, (COMP. 64) said it all. The 
deprotection game can be ugly to some people, but I do 
not feel like a pirate or a person who is committing a 
crime. I do feel like a banker protecting my many 
investments. 

I have not been at the deprotection game long, but 
I hope some COMPUTIST readers can use what I have 
to offer this time. I didn't want to send anything in until 
I had learned enough to be able to explain the logic of what 
I was doing, but I really can't go into a lot of detail about 
each deprotection because I'm not absolutely positive that 
I can explain what I've done on some of the disks. 

Softkey for... 



Mcrozine Jr. /J. Disk 1 &2 
MicroziDe i28 
Microzine ^29 

Scholastic 



These are ProDOS based but strangely the following 
made a copyable disk. (Please, someone tell me why?) 

[T]Boot a DOS 3.3 disk. 

POKE 47426,24 
RUN COPTA 

...answer the prompts for each disk you wish to copy. 

Softkey for... 



Mcrozine f27 
Decimals Disk 1 & 2 

Scholastic 

ACT Preparation 



CBS Software 



[T]BootaDOS3.3 disk. 



RUN COPYA 

ac 

CAU-151 
8993:00 
B99D:00 
B957:00 

8C 



70 
RUN 

...answer the prompts to copy botii disk 1 and disk 2. 
Softkey for... 



Mini Putt 

Accolade 



Us a sector editor with a search routine to scan the 
disk for 80 04 C2 30 38 68 (I found it on track 02, sector OA, 
side 01) and change the 04 to 21 . It will branch to RTL and 
bypass the protection check. After I had already removed 
the protection on my disk I saw a couple of articles on 
removing the protection in COMPUTIST that involved a 
lot of changes. I found that the one change had worked 
perfectly. (Could I possibly have some feedback on this 
from some of you?) 

Softkey for... 



Geometry Disk 1-5 

Educational Courseware 



[TJBoot a DOS 3.3 disk and use COPYA to copy all 5 
disks. 

RUN COPYA 

8C 

CALL -151 

B942:18 

BE48:18 

3D0G 

70 

RUN 

Softkey for... 



Algebra Disks 1-6 

Equations 11 

Binomial Multiplication 

Equations 

Factoring Algebraic Expressions 

Graphing Linear Functions 
Simutaneous Linear Equations 

Microcomputer Workshop Courseware 
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[T]Boot a DOS 3.3 disk and use COPYA to copy the 
disks. 

RUN COPYA 

8C 

CALL 151 

B942:18 

BE48:18 

B993:00 

B99D:00 

B957:00 

70 

RUN 

There is one other disk. Solving Quadratic Equations, 
that I was unable to make COPYA-able. Maybe someone 
can help? 

The following is a list of disks that I need help with: 

Writing SkiUs Series by Edu Ware @1984 

ACT Natural Science Series by NASSP 

Science Series: Earth Science, Body Defenses, Nervous 

System by Prentice Hall 
Carmen-USA and -World (Not one of the articles helped.) 
Baron's Computer ACT 
Let's Explore Basic by Milton Bradley 
Bank Street Writer III by Scholastic (None of die articles 

helped.) 
Go to the Head of the Class by Milton Bradley (Media 

Materials) 
Game of the States by Milton Bradley (Media Materials) 
Micro Power and Light software 
The Teacher's Tool Kit Series by Hi Tech of Santa Cruz 

(the article in COMPUTIST #65 pg. 18 did not work.) 
Montana Reading Program (The article in COMPUTIST 

#63 pg. 8-9 didn't work.) 
Mavis Beacon Teaches Typing 5W" disks. (All of the 

protection removal is for Ilgs versions, didn't help.) 
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Ratings 

<!<?<5<J<! SUPERB 

<?^<!^ EXCELLENT 

<?<?<?. VERY GOOD 

<J<2 GOOD 

^ FAIR 

d) POOR 

(i)® BAD 

d)®® DEFECTIVE 




■ Requires: 

D 512K Apple Ilgs 

D one 3V2" drive 

D joystick recommended 

As you may recall, Elvin Atombender was launched 
upon his life of crime when, in his formative computer 
brat years, a power glitch wiped out months of work. 
Vowing to ' 'make the world pay" , the crazed genius aimed 
to trigger a nuclear cataclysm. The good news is that he 
was? stopped ("Impossible Mission"-!); the bad news is 
that Elvin is loose again (!), richer, meaner, and more 
determined than ever to exact his revenge. 

Epyx's "Impossible Mission 11" casts you in the role 
of an acrobatic CIA agent with just eight hours to shut 
down yet another project for world destruction. The site 
is Atombender Industries' sprawling new HQ complex 
(eight 4-6 room towers surrounding a core tower topped 
by a penthouse Control Room) near downtown LA. To 
prevent the launching of the world's nuclear missiles, you 
must 1.) crack, at least, six safes to obtain the complete 
musical key for the core tower's elevator; 2.) reach Elvin's 
main terminal; and 3.) 'pull the plug'. 

As in IM-1, each room of the new complex is a 
cleverly contrived action puzzle composed of terraces, 
walls, sliding platforms, and lifts— all keyed to one or 
more in-room terminals and linked to the patrol activities 
of robot guardians. Here, hidden in ftimishings and 
equipment, is where you can find the items needed to 
unlock the larger puzzle represented by a tower. Searches 
may yield Terminal Control Icons (to deactivate robots, 
turn on lights, reset lifts, etc.), bombs for blowing safes, 
mines (to blow robots), and Security Key digits. Whether 
or not you succeed in cracking a tower's safe, entry to 
an adjoining tower is blocked unless you possess the 
correct 3-digit 'key' code. 

The better your grasp of how a room 'works' (and 
the more control icons you've collected), the less you will 
need to depend upon arcade ace-class expertise. A well 
thought-out set of on-screen locator, music recording, and 
code-cracking tools helps too; but, basically, the 'trick' 
is still to run, leap, and ride your way through the room 
puzzles without getting lasered, crushed, or otherwise 
reduced to a grease spot. (Each fatality deletes several 
minutes from the countdown timer; and— an 
undocumented feature— too much time without progress, 
ends the game.) Speedy Save/Restore functions let you 
preserve hard-won gains; and, win or lose, an on-disk five- 
position High Scores roster recognizes those special 'great 
performances'. 



Presented in full-color super-res "Impossible Mission 
11" delivers crisply detailed side views of elevator and 
room areas, realistic agent animation, and hordes of nifty 
little robots. Control response is smooth; but movement 
variety qualifies as merely adequate. You can not, for 
example, change the length of a jump; nor can you easily 
separate "search" and platform movement functions. 
Since the program is 'designed around' its controls, 
winnability is not seriously impacted; but, for best play 
in a high resolution 'action puzzle' environment, it's time 
Epyx moved beyond single-button He-class inputs. 

The new "Impossible Mission" wraps you in digitized 
sound, offers an exciting challenge, and, all in all, manages 
to seem very "Possible". (Victory is just around the 
comer; you see the 'light at the end of the tunnel', etc. 
etc.) For those who crave long-playing arcade-spiced 
adventure, this is addictive stuff. 




■ Requires: 

D 64K Apple II series 

n one 514" drive 

D Second drive and printer optional 

For years, the legendary Bracelet of Turani maintained 
good fortune for Aquitania's populace and prosperity for 
the land's stochastic executives. Indeed, the bureaucracy 
charged with "directing the bracelet's luck" —a task 
formerly handled by Turani alone, in his spare time— has 
become a paper shuffling marvel and a major employer. 
When it becomes apparent that someone is compromising 
the bracelet's efficacy, Aquitanian society is, quite 
naturally, shaken to its foundations. 
♦ As the one chosen to put things aright, your first task 
is to make sense of one of Apple text adventuring 's 
wackier, more convoluted, scenarios. Originally, you see, 
Turani crafted the bracelet as a defense against the mischief 
of Aquitania's green witches. It worked so well that the 
witches agreed to 'cool it' . The bracelet, however, also 
produced an unforeseen bounty of good luck, just by virtue 
of its presence in Aquitania. Thus, in a mood for 
compromise, the witches proposed to guard the bracelet. 
They would tolerate its spell dampening influence, 
preferring this to having some renegade mortal access the 
full powers of such a potent artifact. Since witches can't 
stand to touch even one of the five charms on the bracelet, 
the non-witches agreed, seeing the deal as the perfect way 
to prevent tampering with Aquitania's 'golden goose'. 

Everything worked fine until one witch, Jannedor, 
conspired with greedy mundanes to have the charms 
removed and dispersed throughout the land. Now, unless 
YOU can locate all the bracelet's pieces and reassemble 
them, a powerftjl spell will destroy the weakened artifact, 
free the witches of any restraint, end Luck, AND put 
numberless bureaucrats out of work! 

Distinctly Zorkian in flavor, "Jinxter" is a two- 
diskette multi-setting challenge embracing not only a 
town's shops, dwellings, (towers, entertainment centers, 
etc.), but, in addition, the surrounding countryside, woods, 
mines, a weird temple, and more. Here and there, you 
are assured, each of the charms may be discovered; and, 
just maybe, the special powers of some can help locate 
the others. Hardly 'a night's work', this is a large 
adventure loaded with enough diversions, puzzles, and 
places within places to rate, at least, an "Intermediate" 
on the Infocom difficulty scale. 

"Jinxter" support goodies include two "Old Moose 
Bolter" coasters, a copy of the background memo (from / 
the Deputy Under-Secretary's Assistant General 
Secretary), and, hot off the press, the latest The 
Independent Guardian ("Quality News for the Hard of 
Thinking"). Packed with meaty current events items, the 
latter also supplies numerous examples of how one 
interacts with the game's parser AND several pages of 
coded solutions for specific problems. Should you become 
'dead stuck', entering the appropriate code during play 



produces a translation. (Note: The I.G. fails to note one 
important detail; you must be at the site of the problem 
when entering the code.) 

Finally, it seems, someone besides you-know-who has 
discovered 'the secret' for producing first rate text 
adventures. In Rainbird's "Jinxter" you will find the 
excellent parsing, engaging puzzles, picturesque 
descriptions, and humor that make quality 'words-only' 
adventuring a special treat. 

Fast Frames, Updates, Etc. 

NOT a Bug 

Some years back, my dad caught what appeared to 
be a sure bug in the original "Ultima": when an attribute's 
value increments beyond 99, it resets to zero. Well, we 
called Richard Garriot/Lord British and were told that the 
recy dying is, most certainly, not a bug. No indeed, 
Richard explained, it is a "feature" intended "to keep 
players from being too greedy". 

Evidendy, there are many fewer bugs and many more 
features floating around than one might suppose. Last 
month, I reported an apparent "Wizardry V" bug which 
produces unexpected Good-to-Evil shifts in orientation. 
Since the game does not permit forming a party including 
both Good and Evil members (though, interestingly, it will 
not boot out misfits at the time the shift occurs), the result 
can be the loss of valuable personnel. A problem? Yes. 
A bug? No. 

According to Sir Tech's Brenda Garno, when the 
manual says: "Certain peaceful monster types may offer 
your party a truce" (p. 5 8), it is referring to those times 
you encounter messages such as "You see a wandering 
group of Arch Devils Attack/Leave alone". Choosing to 
attack is viewed as evidence of evil inclinations. (Like, 
clearly, you'd have to be really corrupt to beat-up on 
"peaceful" Arch Devils.) Due to a random factor, just 
one such attack may trigger a shift; or, it may take several. 

Roadwar 2000 

This SSI map adventure ($44.95, for 512K Ilgs) is 
set in a post-disaster North America ruled by roving road 
gangs and petty tyrants. Beginning as a small-time 
ganglord, you strive to recruit and upgrade your 'troops', 
win road battles, and secure sources for food, medicine, 
gasoline, and other vital supplies. Your objective, in short, 
is to become a bigtime ganglord. The game's main map, 
a beautiful scrolling pictorial affair in fiiU-color super-res, 
is so well done that it is very hard to believe that the rest 
of the game doesn't 'click into place'; but, in numerous 
tries, it never has. One weakness is documentation: it 
leaves a gaping information vacuum between the scenario 
story and listings of raw statistics. A more serious problem 
becomes evident once you have figured out what's going 
on. Somehow, when it comes to planning and other 
activities, especially combat, the information or display 
you need just isn't there. So, for "Roadwar 2(X)0", neither 
am I. 

Tax Help 

Should you or 'a fiiend' have put off income tax return 
preparation to the last minute, it may be time for some 
high-powered help from your computer. "J.K. Lasser's 
Your Income Tax 1989" ($75, from Simon & Schuster) 
runs on 512K IBM compatibles (e.g. PC, PS/2, Compaq, 
and Tandy) with DOS 2.0 or later and two 5 V4 " or 3 Vi " 
drives and/or a hard disk. The package, which includes 
a 40-page manual and Lasser's telephone directory-sized 
book, is designed to help you organize and file your return 
as well as to plan the best tax strategy for the coming year. 
Thus, for instance, you can read-in files from "Quieten", 
compare 1040 tax scenarios (e.g. filing joint versus 
separate returns), and even print IRS approved 1040 
forms. Aside from, in all probability, a discount on next 
year's update, bonuses include Tax Alert Hotline support 
and a 3-month trial subscription to the J.K. Lasser Tax 
Service Newsletter. 

Masters Help 

If, on the next visit to your favorite software 
emporium, you should happen to purchase one of the Epyx 
"Masters Collection" games, there is a new accessory 
which may be of real interest. Epyx's own Advanced Hint 
Book delivers 46 pages of no-nonsense, low-fluff player 
assistance for "Legend of Blacksilver", "Space Station 
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Oblivion", "LA Crackdown", and "Sub Battle 
Simulator' ' . Coverage is on a 'what you need is what you 
get basis'; so " 'Blacksilver", a large fantasy adventure, 
commands a Ml 27 pages packed with general and specific 
hints plus a complete set of maps. (The more specific clues 
are partially alphabet-substitution encoded to facilitate 
accessing only the information of interest.) 

" 'Oblivion" players get some 'start up' details, 
specific sector-by-sector directions, and a copiable 
polyhedron map cut-out; while, for "Sub Battle'", the 
booklet supplies strategy and tactics hints, including 
several diagrams. Helpful "tips" begin the 
" 'Crackdown" entry, followed by a detailed Case Report 
flow chart. Except for " 'Crackdown", each section opens 
with a brief 'insider discussion' of the ideas behind the 
game's creation. Featuring red and boldface highlighting 
plus expertly done graphic aids, this is a quality 
production; and, at $7.99, a bottleneck-busting bargain. 

Platoon 

Featuring Rarabo-theme arcade action, Data East's 
"Platoon" ($34.95, for 128K Apple II) delivers loads of 
play spread across six challenging episodes. Ideally, your 
aim is to bring your five-man team, intact, through all six 
tests; realistically, you have specific objectives to 
accomplish (e.g. blow up a bridge, etc.) and, of course, 
points to score. (Unfortunately, though, there is no on- 
disk record of high scores.) 

Thanks to excellent game speed and responsive four- 
quadrant controls, the single soldier figure representing 
your party can race along jungle paths, leap over traps, 
kneel and blast enemy troops as they drop out of trees, 
etc., all in colorful double-hires. Each episode incorporates 
several screens— nice because soldier figures and terrain 
features can be large enough for decent detail; but also 
something of a problem, when it comes to getting where 
you need to be. The game's maze-like trails seem to 
encourage mapping; yet, with no PAUSE option and 
constant enemy pressure, mapping is nearly impossible. 
"Platoon" easily ranks among tiie better He format gaming 
parlor translations. As is almost always true of such 
products, the game would be even more fun if translators 
could remember that no one is feeding-in quarters for each 
replay. 

Vendors 

Data East: 470 Needles Drive, San Jose, CA 95112 

(408-286-7074) 

Epyx: 600 Galveston Drive, P.O. Box 8020, Redwood 

City, CA 94063 (415-366-0606) 

Rainbird Software: 3885 Bohannon Drive, Menlo Park, 

CA 94025 (415-322-0412) 

Simon & Schuster: 1 Gulf and Western Plaza, New York, 

NY 10023 (212-373-8142) 

Sir-tech: P.O. Box 245, Charlestown Mall, 

Ogdensburg,NY 13669 (315-393-6633) 

Strategic Simulations Inc.: 1046 North Rengstorff Ave., 

Mountain View, CA 94043 (415-964-1353) 



Michael Reese 



<2> I tried to use a softkey on page 16-17 of 
COMPUTIST #59 (Sept., 1988) written by Mike 
Egnotovich, and could not get the early and straight 
forward instructions to work. I checked the BUGS sections 
of all later issues, but could not find any update. I think 
there may be an error, and wanted to ask if you could refer 
my letter to Mike Egnotovich to check on the possibility 
of an error? 

The problem occurs after the 4th monitor step, where 
we are supposed to boot the program disk by typing 9600G 
(Step #4). That is very simple and logical, but my 
computer just locks up. I have retried many times, widi 
the same results. The usual * prompt disappears, and does 
not return unless I press BRawt, followed by a CALL-151 . 
The drive does turn on if I type the original address (Step 
#2) at $C600G. 

Is it possible that there is an error in the first few steps? 
Your assistance would really be greatly appreciated. 

A I don't mean to pick on you, Michael, but it's letters like 
this one that get ignored by most readers. So please, everyone, 
when you ask a question, give all the information you can 
about your system and what you tried, even if it doesn't seem 
to relate to your problem. Let the reader who is trying to 
answer your question, decide what is or is not important. 



Here is my best guess, based on the info you provided. 
Since the bootO code is being modified, the proceedure should 
work, at least past step 4. 1 can think of two reasons that it 
wouldn't. First, your disk controller is not in slot 6. The bootO 
code uses the its' page alignment to determine what slot to 
access. (IE. A controller in slot 5 would need its code moved 
to $95(X) or $8500 or $7500, etc.) Second, the bootO code 
may not be the same. If you are using other than Apple drives 
or if you are using an Apple He, the boot code and the 
necessary patch would be different. Again, I'm only guessing. 

If you would like to write to Mr. Egnotovich, the procedure 
is for this is printed in the front of each issue, under writing 
to RDEX RDEXed 



A. L. Head, Jr. 



A Treatise on Deprotection 

(using Gradebook III) 



Softkey for. 



Gradebook III 

Schoolhouse Software 



■ Requirements 

□ Apple lie 48K min. 
D COPYA and FID 
D NMI capability 
D 2 drives preferred 

Foreword 

Each issue of COMPUTIST reproduces a part of the 
copyright law that guarantees the owner of a software 
program the right to make certain copies of the program 
for his own adaptation or for archival purposes. In 
accordance with these owner rights, methods for doing 
this copying need to be understood. The general purpose 
of this article is to demonstrate some of these methods. 
Conversely, a programmer (software developer or seller) 
that has slaved over his particular masterpiece wants some 
just reward for his labor. He does not want unlawfiil copies 
made and distributed. The copyright law strikes the 
balance between the needs of the owner and programmer. 

Most users, including programmers, have either 
possessed or do possess pirated software. However, often 
a pirated copy leads to a bona fide purchase to get the latest 
version and the documentation. As for me, I must have 
the latest and greatest of the software that I use. So, in 
the end the programmer benefits and some of us have fun 
trying to beat the protection. Pirated software provides 
potential purchasers with the opportunity to try the 
software prior to purchase. How often does one buy a 
canned program only to find that it does not meet his needs 
when he uses it? This subrosa evaluation of software does 
not cost programmers as much as they advertise because 
of the ensuing purchases of worthy programs that never 
would have happened otherwise. All of this is not a defense 
for unlawful copying; it is, however, an observation of 
conditions as they exist. 

There is no end to the protection schemes that can be 
devised. This fact is what makes the challenge to hackers 
so intriguing. Some of us have been known to buy a $25 
to $30 game just for the challenge of the cadiUac protection 
scheme it may offer. The real game is the quest for and 
the removal of the protection. 

Another observation is that today's hacker is 
tomorrow's programmer and vice versa. Come on people! 
Most of us have been on both sides of the 
protection/deprotection issue. All of you hackers have your 
own protection scheme that is certainly the greatest ever 
that you use to confound your friends. And you, 
programmers!?. How many of you are hackers with 
respect to your competition? Perhaps we have discovered 
the enemy, and he is us!! 

With the above profound philosophical gems in mind, 
let's relax and get on with this article. As implied 
previously, knowledge is the key to the successful 
application of any tool. It is my desire to convey 
knowledge of the what, where, and how concerning the 
softkeys that I submit to this publication. Much of this type 
of detail will be boring to the experienced hackers in our 



midst. For those that are just beginning, it will be a 
refreshing breeze. 

A great educational program has come to my attention 
that suits my purpose for this article. This software is 
called Gradebook HI. It is distributed by a small company 
in Denton, Texas called Schoolhouse Software. At last 
Count it had 1 1 different kinds of protection on it. I suspect 
that the programmer is also a hacker as alluded to above. 
In this particular case, I will expose the protection, define 
its implementation, and remove it. To alleviate the 
programmer's anxieties, I suggest that all you hackers and 
teachers buy Gradebook III; use it to hone your 
deprotection skills; and then donate it to the nearest school. 

Introduction 

Gradebook III (GB3), released in 1986, is a program 
designed to assist teachers in recording, calculating, and 
reporting student grades and averages. A separate data disk 
is used to store class and student records. Up to 8 class 
periods may be stored on a single data disk. Each period 
will store as many as 40 students with 40 grades each. 
When student grades are entered for an assignment or test, 
GB3 updates each students' records, providing for instant 
reports on student progress. 

Gradebook III will accommodate the many different 
ways that teachers use to calculate student averages. When 
a new class is created, the teacher can choose 1 to 7 
different categories into which grades may be classified. 
A different weighting factor may be placed on each 
category so that the overall averages reflect the values 
selected. These factors may be changed at any time. 

Over 15 different reports can be selected for viewing 
or printing. One is the ' 'Parent Letter' ' . This report prints 
personalized letters to the parents or guardians of any 
student regarding that students progress. These include 
letters of commendation, marginal performance, and 
failing performance. All of these letters are contained in 
a BASIC Program that can be customized to a teacher's 
specific preference by anyone familiar with BASIC 
Programming. The reports are contained on a data disk 
called ' 'Parent Letter' ' provided as the back side of GB3 . 
This software program is a very good tool for teachers. 

Gradebook in will run on either a single or dual drive 
system. 

The Examination 

One must develop a systematic procedure for 
determining whether or not a program is protected and 
what the protection is. The best way to start is to try to 
make a backup copy using standard copy procedures. I 
use Locksmith 6.0 (LS6) Fast Disk Backup (FDB) for this 
purpose because it is fast and it will display, on a 
track/sector grid, any errors it encounters during the copy 
process. If no errors are encountered, a dot will be 
displayed for that sector. An "A" will be displayed for 
an address field error, and a "D" will be shown for a 
data field error. In less than 15 seconds, much can be 
determined about a disk. Applying this procedure to GB3 
shows address field errors on all of side 1 , the program 
disk. No errors are indicated on side 2, Parent Letter. 

The type of errors found by FDB are caused by 
formatting alterations. The next step is to identify what 
these are. One of the best tools available to do this is the 
LS6 Disk Editor (Nibble Editor). Boot into the main menu 
of LS6 and press N to enter the Disk Editor. Read in a track, 
say track $0A, for example. Press 8R 2 A return to read 
in track $0A from drive 2. Press D. This is a 16-sector 
address decode command. The screen display will change 
showing the buffer address for each sector, the volume 
number, the track/sector numbers, and error indicators if 
any. If "?" is displayed, the address field checksum or 
epilogue is incorrect. If "CS" is shown, the data field 
checksum is bad. If " * " is displayed, something is wrong 
with the data field information—usually prologue or 
epUogue alterations. Applying this technique to GB3 shows 
errors of "?" and "*" on every sector. This means that 
the address field checksums and/or epilogues are non- 
standard and that the data field prologues and/or epilogues 
are corrupted. The volume number shown is $FE (254). 
Applying the same procedure to the Parent Letter disk 
shows everything to be normal (standard format). 

Next, press space to return to the Disk Editor display. 
Using cursor movements, find several address fields 
followed by the corresponding data fields. It can be seen 
that the lead-in sync field is of mixed values— not the usual 
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$FF's. This may or not be important. Note what the 4 or 
5 values are just prior to the address prologue, especially 
if they are the same for each sector. I found these values 

to be (EB) (AB) (FF) (BF) (EB) D5 AA 96 The 

parentheses ( ) indicate sync-bytes. Examination of the 
other data in the address and data fields show standard 
prologues and altered epilogues. The epilogues for both 
the address and data fields are $FF $FF instead of the 
normal $DE $AA. The value of the sync bytes before the 
data prologue is $AB. It still has not been exclusively 
determined whether or not the address field checksums 
have been altered. 

The next step in the examination is to patch the disk 
operating system (DOS) to accommodate the altered marks 
and then see if the protected disk can be read. This can 
be accompli^ed within LS6 by pressing ew to escape from 
the disk editor to the main menu. Then press L to load 
Inspector/Watson (lAV), the sector editor. When this is 
done, press * to patch the resident DOS. It is standard. 
Type the following: 

B935 FF was DE, 1st data epilogue byte 

B93F FF was AA, 2nd data epilogue byte 

B991 FF was DE, 1st address epibgue byte 

B99B FF was AA, 2nd address epilogue byte 

To see what is in a memory location, type SHOW B93S 
return, for example. The hexadecimal (hex) value in that 
location will be displayed. When done, press ew to return 
to the menu. Now, press I to call I/W. The idea is to read 
some meaningful tracks and sectors. Look at the normal 
catalog track. From I/W press D to toggle to drive 2 and 
then T 11 return, S F return to set track $11, sector $0F. 
Press R to read the sector into the buffer. The sector is read 
with no I/O errors. Press A to toggle the hex/ ASCII 
display. In the ASCII mode, one should be able to read 
the name of the first group of files, if a file structure is 
on the disk at the standard position. Some things can be 
seen that seem recognizable, but most is written in 
gibberish. Try another track and sector where there is 
code. Toggle back to the hex display by pressing A then 
press SD to disassemble the code. Either intelligible code 
or gibberish will be displayed. In our case the sectors are 
. . read but the code is corrupt. This is a sure sign that that 
some non-standard encoding procedure has been used. 
Usually this is done by tampering with the read and write 
translate tables located on page $BA of memory, or on 
tradk $00, sector $04 of a standard DOS 3.3 disk. The 
read and write tracks and sectors (RWTS) part of DOS 
is loaded during boot stage 1; that is, track $00, sectors 
$00 through $09 are loaded mto pages $B6 through $BF 
of memory, respectively. Boot ROM routines are used to 
do this, page $C6 in ROM. The read/write translate tables 
are being read in by standard encoding techniques unless 
a more severe DOS alteration is being used. It is worth 
a try to see if track $00, sector $04 can be read using 
standard read/ write encoding tables. From I/W press T 
return, S 4 return, R. The write translate table extends 
from byte $29 through $68, and the read translate table 
extends from byte $96 through $FF. The programmers 
of GB3 have not moved the tables. They are there and 
readable! Further examination of these tables shows that 
$AA and $96 have been interchanged. Specifically, byte 
$29 in the write translate table has been changed fi-om $96 
to $AA. This means that a value of $00 in memory will 
be written to disk as $AA instead of $96. The 
corresponding value at byte $AA in the read translate table 
is $00 instead of the standard value of $AA. This means 
that if $AA had just been read from the disk, it would be 
translated as $00 instead of $AA. Therefore, the encoding 
to and decoding fi-om disk is affected. If standard tables 
are used to read a disk written with altered tables, gibberish 
results for any byte related to either $AA or $96. 

To test the above findings, set the buffer to page $BA. 
From I/W press B BA, return. This shows the read/write 
translate tables in LS6, which are standard DOS 3.3. Edit 
byte $29 fi-om $96 to $AA. Press E29, space AA, return. 
Also, edit byte $AA. Press E AA, space 00, return. This 
patches memory. Reset the buffer to $4000. Press B 40, 
return. Reset track and sector to track $11, sector $0F. 
Press T 11, return, S F, return. Press Rto read it in. Toggle 
to ASCn with a press of A. Presto, the first group of files 
can now be read. Try a few other sectors. Especially, try 
track $01, sector $09. This is the sector in standard DOS 
3.3 that contains the name of the startup file. Press T 1 
i, S 9 return, R. Stay in the ASCII display. Beginning 
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at byte $75 "HELLO" is displayed. This is the name of 
the startup file. It is obvious that the code from disk is 
now being translated correctly. Referring to a previous 
comment, the ability to read sectors correctly does prove 
that the address field checksums have not been altered. 
The examination to this point has provided the 
following information: 

1 . The lead-in sync fields on GB3 have been changed 
to be (EB) (AB) (FF) (BF) (EB) prior to the address 
prologue instead of FF's. 

2. The address and data epilogues have been altered 
on GB3 to be FF FF mstead of DE AA. 

3. The read/write translate tables of GB3 have been 
modified to interchange AA and 96. 

4. Sectors $00 through $09 of track $00 are written 
with standard read/write translate tables. 

5. Gradebook m is at least partially file based with 
a startup file of HELLO. 

6. The back side, "PARENT LETTER", is in 
standard format, catalogable from normal DOS 3.3, and 
apparently unprotected. 

Resolve one of the questions by making a standard 
backup of PARENT LETTER, the back side. Use FDB 
from LS6, standard COPYA from the DOS 3.3 System 
Master Disk, or any other whole disk copier. Boot the 
backup. It will boot and run its HELLO file. Label this 
backup "PL". It is important to note that this is a data 
disk for GB3 that is included as an example and that it 
has files on it needed in the operation of GB3 . This means 
that GB3 must be able to read and write to a standard disk. 
Therefore, GB3 must have a DOS switching subroutine 
somewhere, because it also has to read itself, a protected 
disk. 

The Normalization 

The effort will now be focused on GB3; however, 
there is more than one way to proceed. If the protected 
program is file based, it is usually best to liberate the files 
and transfer them to a standard format. All DOS 
modifications are by-passed with the use of standard DOS 
3.3 or one of the fast-DOS 's. The files can then be 
examined more conveniently. If there is no additional 
protection, the program will run. 

Another approach is to use SUPER lOB to copy the 
entire protected original to a standard format and then 
patch the DOS on disk to circumvent all remaining 
protection schemes, such as disk checks and DOS 
modifications. For this approach to succeed on GB3, the 
first ten sectors ($00-$09) of track $00 will have to be 
copied using standard read/write translate tables. All other 
sectors must be read with the altered read/write translate 
tables and written to disk with standard tables. 

The deprotection procedure is different for each 
protected disk. It involves a trial-and-error process based 
on what is known. Using LS6, the original has been read 
by patching the standard DOS in LS6 to recognize the 
altered epilogues and then patching the read/write tables 
consistent with the the altered values of GB3. A controller 
for Super lOB (input/output control block) can be written 
to do the same thing and that will eventually be done. 
Everyone may not have Super lOB, but nearly everyone 
does have COPYA from the DOS 3.3 System Master Disk. 
COPYA is an excellent copy program, and it can be 
patched to read most protected disks and re-patched to 
write in standard format. Some of the more notable 
adaptations of COPYA are COPYB by Krakowicz and 
ADVANCED COPYA by the Disk Jockey. Both permit 
the use of a captured RWTS from a protected program 
to read while writing with a standard RWTS, in much the 
same way that is done with a swap controller in Super lOB. 
All that is needed here is COPYA and COPY.OBJO on 
the same disk. Both of these are on the DOS 3.3 System 
Master Disk. 

TABLE 1 is an executable text file named 
COPYA.GRD.BK.TXT, included at the end of this article. 
When executed, this file will load COPYA, patch it to copy 
GB3, and then run it. Put COPYA.GRD.BK.TXT, 
COPYA, and COPY.OBJO on the same disk and place that 
disk in the drive of your choice. Do the following: 

Pal With standard DOS resident, place the disk 
containing the COPYA files in the drive of your choice. 
Place a blank disk in the other drive. 

BXEC C0PTA.GRD.BK.1XT, Ds x=drive # of COPYA files 

r~b1 Follow the prompts. When the duplicate is finished. 



exit COPYA. Label the duplicate "BUI". Then: 
CATALOG, Dy y=drive It of duplicate 

The catalog of GB3 should now be displayed in its 
fiilhiess. There are 5 Applesoft (including HELLO), 2 text, 
and 1 binary files. See TABLE 2. 

The disk "BUI" will not boot. Remember the first 
ten sectors of track $00? However, the files can be 
transferred to a disk containing standard DOS 3.3. It is 
known that die startup file is HELLO. To complete this 
approach, boot into standard DOS 3.3 using the System 
Master Disk or boot into a fast-DOS, such as Diversi- 
DOS. Get into BASIC and do the foUowmg: 

I c| Place a blank disk in drive 2. 

NEW 

INIT HELLO, D2 
DELETE HEUO 

f~dl Place a disk containing FED in drive 1. (FID is on 
the DOS 3.3 System Master Disk.) 

BRUN FID, Dl 

m Select 1 COPY FILES. Answer the prompts for 
source and destination slot and drive numbers. In response 
to the FILENAME prompt, enter " = ". In response to 
DO YOU WANT PROMPTING, enter "N". 

m Place BUI in drive 1 and transfer all the files to the 
initiaUzed blank in drive 2. When completed label the disk 
in drive 2 "BU2". 

Note: An alternate way to copy the Hies from BUI 
to BU2 is to use Copy n Plus Utilities for those that have 
Copy n Plus. 

The disk labeled BU2 has a standard DOS with the 
files of GB3. If no other protection is present, it should 
boot and run. Place the disk labeled "PL" in drive 2. Be 
sure that it is write enabled. Boot BU2 from drive 1. The 
program loads and the logo appears. In response to the 
query about number of drives, enter "2". The menu 
appears next. In response to any of the options that require 
access to the data disk, the program bombs into the 
monitor. Therefore, additional protection does exist. This 
is not surprising, since the program execution switches 
fi"om the protected program disk to the normal data disk 
and vice versa. The resident DOS must be switched 
correspondingly. The next task is to find the switching 
calls. 

The brute force way to search for the DOS switching 
subroutine is to load the Applesoft programs and look. 
Place "BU2" in drive 1 and boot it. Press SC 
immediately to force a break. At the break, the file 
"HELLO" has been loaded but not executed. List it by 
typing LIST return. This file loads graphics (the logo), 
displays it, pokes an error handler subroutine into page 
$03 for ONERR, and RUNS HELLO H. There are no 
switching calls here. 

r~g] Continuing with the program flow, type: 

NEW 

LOAD HELLO II 

PRj» 

LIST 



Switch to 80-colunms 
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Remember, a S S key press will stop the listing and 
any other key press will start it again. The listing does 
not proceed very far before an interesting CALL is seen 
in line 20. This line instructs the user to "INSERT 
GRADEBOOK m DISK & PRESS RETURN". A 
"CALL 47721" is then given prior to accessing GB3. 
Next, in line 26 a "CALL 47741" is given prior to 
accessmg the data disk. The memory addresses in hex 
notation are $BA69 and $BA7D, respectively. These are 
on the same page of memory that contains the read/write 
translate tables previously discussed, and they are in a 
crack in normal DOS 3.3 (an unused part of memory) diat 
is located between the write and read translate tables 
($BA69-$BA95). To view this area of memory one needs 
a non-maskable interrupt (NMI) capability. The original 
cannot be interrupted with B C or B reeet. I use the Senior 
PROM to interrupt programs protected diis way. Without 
explanation of how Senior PROM works, the following 
must be done. The GB3 program execution is interrupted 
after DOS has been loaded, and the monitor is entered. 
A disassembly of the code beginning at $BA69 shows the 
subroutine. The next move is to save the GB3.RWTS for 
future reference. It must be moved down in memory out 
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of the way of a re-boot. For example, to move the entire 
RWTS give the monitor move command, 8600<B600. 
BFFFM ratnni. Next, turn off the NMI switch, then warm 
boot a DOS 3.3 slave disk with a null HELLO, 6 BP, 
retmn. When the Applesoft prompt Q) appears, save the 
entire RWTS by typing: BSAVEGB3.RWTS, A$8600, LSAOO 
retum. A shortened version, usually used with a Swap 
Controller in Super lOB, extends from $8800 to $8FFF. 
I have written a short program to make a text file out of 
the disassembled code of interest. TABLE 3 shows diis 
annotated disassembly listing. For those without an NMI 
c^ability, this code can be seen on track $00, sectors $04 
and $06 of die original GB3 disk. Boot LS6; defeat the 
altered epilogues; enter lAV; set the track, sector, and 
drive; and read the sector into the buffer. Disassemble the 
code with a 8D key press. The procedure was explained 
previously when discussing alterations in the read/write 
translate table. 

Referring to TABLE 3, the "CALL 47721" ($BA69) 
installs the DOS modifications. The "CALL 47741" 
($BA7D) standardizes DOS. It can be seen that there are 
jumps to subroutines (JSR) at $BCDF and $BCEC. The 
memory range of $BCDF through $BCFF is another crack 
in normal DOS 3.3. The code to change the epilogues is 
placed here. All of these modifications except one have 
already been determined. This one, shown at $BA69 and 
$BA7D, alters the write routine. When altered, sync $AB 
values are written prior to the data field header. When 
normalized, this value is sync $FF. This alteration would 
only be used during the initialization of the original GB3 
disk. As noted during the initial examination, sync values 
of $AB are indeed written before the data field headers 
of die original GB3. The initialization of data disks from 
the option to "CREATE DATA DISK" will write the 
normal sync value of $FF prior to the data field header. 
This alteration has no significance relative to normalizing 
and reading GB3. The major benefit of finding this DOS 
Switching Subroutine, is the validation of what the DOS 
modifications are. 

With the positive identification of the DOS switching 
calls, the remaining task is to find aU occurrences of these 
calls and remove them. This can continue to be done by 
the brute force method previously started; that is, load each 
Applesoft file in turn and search through it. An easier way 
is to use a program line editor such as the Global Program 
Line Editor (GPLE) published by Beagle Bros. This utility 
fiinctions much like a word processor for Applesoft 
programs. Using the search and replace command, all 
occurrences of "CALL 47721" and "CALL47741" can 
be quickly found and replaced, if desired, widi a null 
string. I have done diis for all of the files on GB3 and 
on PL. The file edits needed to remove these calls are 
contained in two text files named GRADE.BK.TXT and 
PARENT.TXT, TABLES 4 and 5, respectively. When 
executed, these text files successively load, edit, and save 
each Applesoft file diat needs editing. Do the following: 

nil From a normal or fast-DOS, place die disk 
containing GRADE.BK.TXT in the drive of your choice. 
Place the BU2 disk in the other drive. 



EXEC GItADE.BK.TXT, Dx 

GRADE.BK.TXT disk. 



where x=drive number of 



FT] Follow the prompts and use PARENT.TXT and PL 
to complete the procedure. 

The edited BU2 and PL disks are now completely 
deprotected. They will boot in much less time than die 
original if a fast-DOS was used in step (c) above. 

Additional Study of the Protection 

Steps (a) through (i) above define a way to produce 
a deprotected backup. By normalizing die format, 
transferring the files to a disk widi a standard DOS 3.3, 
and editing die files to remove calls to a DOS Switching 
Subroutine a completely normal backup has been obtained. 
Often this basic method is successfid. It is instructive to 
take a closer look at die protection diat has been by-passed 
by the approach just defined. 

Boot code tracing will always show what is happening, 
but is is not always easy to follow. This approach is based 
on the fact that the computer must be abl& to read track 
$00, sector $00 of any disk to begin the boot process. This 
is done by a boot code located in read-only-memory 
(ROM) on die Disk H Controller Card (page $C6, if die 
conttoller card is in slot 6). This code is called Boot Stage 



0. Its purpose is to read track $00, sector $00 (Boot Stage 
1) into page $08 of memory and then execute it beginning 
at $801. This boot stage loads die RWTS and Boot Stage 
2 into memory and dien jumps to Boot Stage 2 to load 
the rest of DOS into memory. Hence, this is called a boot 
strap process, because it is like hauling one's self up by 
one's boot straps. If the program is file-based, a startup 
file (usually called HELLO) is executed to run die 
program. Boot code tracing has been described many times 
in this publication and elsewhere. A few of the steps will 
be defined here for completeness. Do the following: 

I aa| Turn the computer on with no disk in the drive and 
press Snwt. 

enter the monitor 

Move boot ROM down 

add jump to monitor 



CALL -151 
8600<C600.C6FFM 
86F8:4C 59 FF 



fab] Insert die original GB3 disk in drive 1. 

MOOG Execute relocated boot ROM 

C0» Turn the drive off 

1 8P 801LLLLLLL 

The above steps produce a print-out of a disassembly 
listing of Boot Stage 1 . A pertinent part of diis listing is 
shown as TABLE 6. As indicated on die listing, it is 
standard dirough $849. At $84A tiiere is an indirect jump 
through $BBFE. On a normal disk this would be an 
indirect jump dirough $8FD to $B700 (Boot Stage 2). One 
is looking for any kind of change from normal. When 
found, it must be pursued. 

I ac| On with the trace. 
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86F8:4C 01 88 N 8800<800.8Fm 

At diis point die boot ROM at $8600 has been altered 
to point to Boot 1 at $8801. This code will have to be 
altered so it will run at tiiis location. All direct addressing 
to $08xx has to be changed to $88xx. There are ten of 
diem. Disassemble die code (8801LL), find die locations 
diat need to change ($08 to $88), and make die changes. 
After the changes are made, do the following: 

884A:4C 59 FF N 8600G 

C0E8 Turn the drive off 

1 eP BBOOLLLLLLL , Ust page $BB to printer 

At the end of step (ac), you have a disassembly listing 
of page $BB. This is code loaded into die DOS primary 
buffer. It is included as TABLE 7. If garbage is listed, 
review the changes made in step (ac). If one continues to 
have trouble, use an utility like lAV in LS6. Defeat die 
epilogue check and read track $00, sector $00 of die 
original GB3 into die buffer. This code is Boot Stage 1. 
Disassemble it and one has TABLE 6. Likewise, read tiack 
$00, sector $05 into the buffer and disassemble it. This 
produces TABLE 7. These codes can be found on a disk 
using a search utility; however, it is obvious that GB3 is 
using a standard load of die protected RWTS. This means 
diat sectors $00 dirough $09 of track $00 load into pages 
$B6 through $BF of memory, respectively. 

A casual glance at diis code in TABLE 7 reveals diat 
it is the disk check subroutine. It is completely annotated 
for the benefit of die beginners. Remember die exit of Boot 
Stage 1 dirough $BBFE? A review of diis address shows 
that die execution jumps to $BB00. The following are the 
highlights of this disk check: 

1. The Run flag is set ($BBOO). This means diat any 
command will cause an Applesoft program to run. 

2. The stiring "EB D5 AA is sought. The search will go 
on forever if not found. 

3. Pages $08 dirough $95 are filled widi die value 
$4C. This is part of a later check. 

4. The DOS read error check is disabled and the lOB 
is set up to read track $00, sector $0A. A buffer is 
established at $4000 

5. The primary and secondary DOS buffers are moved 
to $6B00-$6C55. 

6. The sector is read on the first pass, then the 
secondary buffer is moved to page $5C. ^B02 is stored 
at $06. The sector is read again and $6B02 is stored at 
$07. Again, die sector is read widi $6B02 stored at $08. 
The DOS secondary buffer is compared byte-by-byte with 
die values transferred to page $5C during die first read. 
If any of die compared valued are unequal a failure branch 
is taken. If the comparison succeeds, tiien $06 is compared 
widi $07. If $06 <> $07, die good branch is taken. If 
$06=$07=$08 ($4C for instance), die disk check is 
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repeated. 

7. If the good branch is taken, the read error check 
is re-established and the DOS buffers are restored to tiieir 
normal position. Execution then jumps to $B700 (Boot 
Stage 2). 

This is a rather involved disk check and it takes some 
understanding. First, the run flag is set. Second, the sync 
$EB just prior to die address prologue is checked. This 
is an answer to an earlier question. Third, a disk check 
is made of track $00, sector $0A. An examination of track 
$00, sector $0A shows that it is a sector of non-standard 
lengdi, diat has die first $55 (86) nibbles as reasonable 
disk nibbles. The balance of die sector contains mosfly 
illegal nibbles with no recognizable data trailer. 

To understand the check of sector $0A, one needs to 
dioroughly understand how DOS 3.3 processes data to and 
from disk. "Beneadi AH)le DOS" published by Quality 
Software is an excellent reference for all things relative 
to DOS 3.3. Here, I will describe what happens without 
trying to explain why. When a sector is read, die secondary 
buffer, which has been moved to $6C00-$6C55, contains 
die first $55 (86) data nibbles from die disk, high to low. 
This corresponds widi die fij-st $55 nibbles in sector $0A. 
Therefore, each time the sector is read, these values will 
be the same. The balance of the sector is read into the 
primary buffer now located on page $6B, die entire page. 
Disk nibbles are placed here, low to high. In the general 
flow of data processing, tiiese nibbles in the DOS buffers, 
$155 (342) in all, are translated into $100 (256) data bytes 
diat fill a page of die memory buffer defined in die lOB. 
All of diis means diat die check to compare $5C00,Y widi 
$6C00,Y on a byte-by-byte basis should show that 
corresponding bytes are equal. The next check is to 
compare $06, $07, and $08. The values stored in diese 
locations are die values of $6B02 for tiiree successive reads 
of the sector. In general these values will not be equal for 
an original GB3 because of die illegal disk nibbles. This 
is an insidious disk check scheme. If one copies the original 
by ignoring unreadable sectors, the first part of the check 
will pass but the second part wiU not. When an unreadable 
sector is encountered, die copy is left filled widi zeros; 
therefore, die check for the copy will show that 
$06 =$07 =$08, and the disk check will go into an endless 
loop. It is obvious that die only reasonable way to duplicate 
this sector is with a bit copier. 

Another Approach to Normalizing 
Gradebook III 

Under the Normalization Section above, a quite valid 
method of standardizing GB3 was presented. That metiiod 
involved the use of tools that almost anyone has. In this 
section another method of obtaining a backup is given. 
This method uses Super lOB 1.5 to completely deprotect 
GB3. A controller for Super lOB 1 .5 must be written that 
performs all of the things previously discussed to 
normalize the backup. The approach is to normalize die 
format, standardize die DOS diat is on GB3, defeat die 
disk checks, and edit all of the files that need editing. When 
all of diis is done, die backup obtained will fiinction 
normally; however, a Swwt key press will clear die screen 
widi inverse "C's" and re-boot. Bah! One got by. When 
8i»«et is pressed, execution jumps through the reset vector 
at $3F2-$3F3. Normally, this vector points to $9DBF in 
memory. The jump to diis address reconnects DOS 3.3 
and leaves the machine in Applesoft basic. In GB3, this 
reset vector has been altered to point to some other 
subroutine. Booting GB3 again and using die NMI of die 
Senior PROM to break into the monitor allows one to 
examine die code at $3F2. This shows values of "5B B7 
12" which means diat die reset handling routine is located 
at $B75B. Page $B7 is loaded from frack $00, sector $01 . 
Use I/W to read this sector, disassemble it, and examine 
the code at byte $5B. This code must be changed to regain 
confrol of the reset function. A patch could be placed at 
byte $5B, but it is more informative to place it at byte $65. 
For now enter "4C 59 FF" beginning at byte $65. This 
will cause execution to jump into the monitor if Breset 
is pressed. Write diis change back to disk and re-boot GB3 . 
Press Srewt when the logo is on the screen. When the 
monitor prompt (*) appears, type 9DBFG return to enter 
BASIC. Then type UST return. The BASIC program in 
memory runs and the logo re-appears. This means that the 
run flag has been set. Press Breset again to enter the 
monitor. Type D6 retum and an $FF is displayed. 



coMPunsT m6 



confirming that the run flag is set. Remember, the run flag 
was set at the beginning of the disk check subroutine on 
page $BB (TABLE 7); however, an edit at $84A in boot 
stage 1 (line 1220 of controller) by-passes this subroutine. 
This means that the run flag is being set again somewhere 
else. The code to set the run flag looks like this: A9 FF 
85 D6 (Load the accumulator with FF and store it at D6). The 
backup disk now being used can be scanned to find all 
occurrences of this code. Using the search function within 
I/W, this string is found at track $00, sector $05, byte 
$00, as previously noted, and track $00, sector $0D, byte 
$30. Edits can now be added to track $00, sectors $01 
and $0D to normalize the reset fiinction and clear the run 
flag. A controller that will do all of the above is presented 
as TABLE 8. A detailed commentary about each line of 
this controller follows: 

1000 REM Statement identifying the controller. 
1002 REM Statement identifying the publisher. 
1003-1010 Instructions concerning the backup and 
related code. 

1015 Initializes Super lOB to copy tracks $00 thru 
$22. The poke causes unreadable sectors to be ignored. 
1020 Alters the write and read translate tables as 
discussed in the Examination section. 

1025 Toggles "CD" to read, restores the data pointer 
to zero, uses altered epilogues as contained in the data 
statement of line 1200, reads a range of tracks, sets the 
entry conditions for the sector editor, jumps to the sector 
editor to execute any appropriate edits contained in the 
data statements of lines 1210 thru 1290, and reset TK. 
1030 Toggles "CD" to write, normalizes epilogues, 
normalizes write and read translate tables, and writes the 
range of tracks to disk. 

1032 Checks if TRK = 35. If true, jumps to line 1050. 
1034 Checks if TRK =1 and LT = 1. If true jumps 
to line 1055. 

1040 Resets TK and ST for start of next range of 
tracks and then jumps to line 1020. 

1050 Checks to see if line 340 is located in memory 
at normal position and then changes 15 to 09. This is an 
edit on a running basic program that sets the sector editor 
for editing 10-sector reads. If all checks, jumps to line 
1054 

1051-1053 Instruction regarding 10-sector patch if 
patch fails. 

1054 Initializes Super lOB to read first 10 sectors of 
track $00, alters lOB.OBJO to reflect sector $09 as the 
last sector, and jumps to line 1025. This setup re-reads 
track $00, sector $00 thru $09 and writes them back using 
normal write and read translate tables. 

1055-1 110 Instructions about GRADE.BK.TXT, then 
executes GRADE.BK.TXT. Note line 1110 that 
reconnects DOS and repeats line 1 100. 

1200 Data statement containing the altered epilogues. 
1210-1290 Data statements containing 25 sector edits. 
Notice that this controller EXECutes the text file 



Sector edits perfovmed by the controller 

Trk Set Byte From To purpose 



$00 $00 
$00 $01 
$00 $02 



$00 $03 

$00 $04 

$00 $06 

$00 $0D 

$11 $00 



$4A 6C 

$4B FE 

$4C B3 

$65 A9 

$66 00 

$67 8D 

$3E AB 

$4A A9 

$4B AB 

$4C 20 

$40 8D 

$4E B7 

$9E FF 

$A3 FF 

$35 FF 

$3F FF 

$91 FF 

$98 FF 

$29 AA 

$AA 00 

$AE FF 

$B3 FF 

$31 FF 

$40 00 

$41 00 E0l 



4C| 

00 

B7l 

4C| 

BF 

9dI 

FF 

48 

68 

20 

B9 

88 

DE 

AA 

DE 

AA 

DE 

AA 

961 

aaI 

DEI 

AAI 
001 
FFI 



Bypass disk check by 
jumping directly to 
Boot Stage 2 (B700) 

Normalide reset vector 
to point to $9DBF. Jump 
into BASIC. 



Normalise write routine 



I Write data epilogues 

I Read data epilogues 

I Read address epilogues 

Nomaliie write/read 

translate tables 
Write address epilogues 

Clear run flag 
Free eleven unused 
sectors on track $fX2 



GRADE.BK.TXT (TABLE 4) which in turn EXECutes 
the text file PARENT.TXT (TABLE 5). This feature of 
the controller illustrates the power of properly conceived 
EXECutable text files. Also, notice the patch to a running 
BASIC program in line 1050. This is another unusual 
feature. This controller demonstrates that almost any disk 
can be normalized with Super lOB if the original disk is 
written in a regularly sectored format and if the protection 
details are known. 

The edits performed by the controller normalize the 
modified DOS on the disk and alter the bit map to free 
eleven (1 1) unused sectors on track $02. The EXECution 
of the text files by the controller, edit die Applesoft files 
to remove all calls to the DOS switching routine. Install 
the controller in Super lOB 1.5, accept the format option 
when given, follow the prompts, and complete the 
procedure. The backup that results will have all protection 
stripped away and will be COPYA-able. A fast-DOS can 
be added, if desired, to speed up disk access by a factor 
of about two. 

A Protected Backup 

The final way of producing a backup of GB3 will use 
the bit-copier, LS6. This method will yield a protected 
backup. One might wonder why a protected backup would 
be desired. Sometimes it is the only kind that can be 
obtained. The more important reason is that the protection 
is preserved for those of us that study such things, 
permitting the protected backup to be used for further 
deprotection efforts. Attempting to backup GB3 with all 
of the popular bit copiers show that they all choke on track 
$00 to some extent. They have trouble finding the track 
start. Locksmith 6.0 will successfully copy GB3 if the 
default procedure is changed. Boot LS6 and do the 
following: 

* press asterisk at the menu 

PAT7 EBD5AA96FFFE7?AAAA??FFFF 

esc press escape to return to the main menu 

B and follow the prompts. 

If the backup will not boot, recopy track $00 only. 
Be sure and make the change to PAT7 each time. 

With the protected backup one can use LS6 to disable 
the epilogue checks, and then use lAV to read track $00, 
sector $05 into the buffer (TABLE 7). The procedure for 
doing this was described under the Examinafion section. 
By editing this sector to place jumps into the monitor at 
strategic locations, one can learn much about the 
protection. For instance, a jump into the monitor can be 
placed at byte $CC after all the checks have been made. 
Edit byte $CC by entering 4C 59 FF (jump to the monitor). 
Write this change back to the disk. Soon after the boot 
begins, the monitor prompt (*) will appear. Then, all of 
the areas of memory that have been discussed, can be 
examined. This procedure illustrates one way a protected 
backup can be used to understand the protection better. 
Generally, the boot stage sectors on the disk can be edited 
to jump into the monitor at any position of the boot. This 
can take the place of an NMI when one can decipher the 
boot stage codes. 

Conclusions 

The purpose of this article was to provide a 
deprotection treatise about some of the protection 
techniques in use today. Gradebook m was used as an 
example because of the plethora of prptection it offers. 
A summary of the protection is given below: 

DOS Modifications 

Address and data sync-field alterations 
Address and data epUogue alterations 
Alter the write routine 
Read/write translate table alterations 
Set the run flag twice 

• Re-route the reset vector to re-boot 

Disk Checks 

• Check for $EB prior to address prologue 

• Disable DOS read error check 

• Read a corrupted sector (Trk $00, Sec $0A) three 
times and perform sophisticated checks 

DOS Switching Routine 

• Reads both protected program disk and normal data 
disk 

There are three (3) types of protection and eleven (1 1) 
applications of this protection. This qualifies GB3 as one 
of the heavily protected programs. It is certainly an 






outstanding example upon which to practice. 

It should be clear that a systematic procedure is 
required to discover what the protection is. A log should 
be kept about everything that is found and about what is 
done about it. Copious notes, listings, disassembly listings, 
and backup attempts are all very helpful, if not required. 
Date each of them because a deprotection effort usually 
extends over a period of time. The best way to describe 
it is to keep notes as if you were going to write an article 
about the experience. Write to yourself, if no other. I keep 
files on each program I work on. 

A knowledge of the DOS being used is most helpful. 
In the Apple n worid DOS 3.3 and ProDOS are the main 
operating systems in use. There are still a few DOS 3.2 
programs. DOS 3.3 is being phased out leaving ProDOS 
as the main one in use. There is no alternative to learning 
what these operating systems do and how they do it, if 
one wants to become proficient at removing protection. 
This implies that assembly language must be learned. As 
demcmstrated in this article, it is at the assembly language 
level that most protection schemes are implemented. This 
knowledge does not easily come to someone unfamiliar 
with number systems to different bases or unfamiliar with 
how computers work. However, assembly language books 
are available at almost any book store for any micro- 
processor of interest. One must dive in and start. It is 
important to add that one does not have to become an 
assembly language programmer to understand it 
sufficientiy. It is like the person that moves to a foreign 
country. He can understand a new language long before 
he can speak and write it. 

As important as having a knowledge of the subject, 
is having the tools of the trade. An expert mechanic cannot 
do much without his tools. In. this business, the basic tools 
are mentioned in this article. A method of interrupting the 
execution of a program is ahnost essential. Senior PROM 
and Replay n serve this purpose. Wildcard II is another. 
The bit-copier programs and their utilities are very helpfiil. 
All are needed. I use LS6 and Copy n Plus most. The 
utilities provide sector editors, nibble editors, disk scan 
capability, memory search capability, disk speed checks, 
and others. Two other very useful programs are The CIA 
Files and Bag of Tricks 2. Bag of Tricks 2 has most of 
the utilities for either DOS 3.3 or ProDOS. Also, Senior 
PROM has most of the utilities needed on a PROM, 
providing instant access from an interrupt. 

In this article, the use of LS6 has been demonstrated 
while performing the deprotection tasks. The Senior 
PROM provides the same capability as LS6 in almost the 
same format. It does not have tiie bit-copier option, 
however. 

This bring to a close this rather long article. If it has 
been educational and has made lucid some of the protection 
techniques, it has achieved its mark. If not, well, maybe 
next time it will. 

That's all folks. 

Table 1: COPYA.GRD.BK.TXT 



NEW: HOME 

LOADCOPYA 

177P0KE47426,24 

197P0KE47413 , 255 : P0KE47423 , 255 : POKE47505 , 255 : POKE 

47515 , 255 : P0KE47657 , 170 : P0KE47786 , 
225VTAB5:HTAB24: ?"'" : IFPEEK(713)=1THEN258 
248P0KE47426 , 56 : P0KE47413 , 222 : P0KE47423 , 170 : POKE 

47505, 222:POKE47515,170:POKE47657,150;POKE 

47786,170 
258P0KE47426 , 56 : P0KE47413 , 222 : P0KE47423 , 170 : POKE 

47505 , 222 : POKE47515 , 170 : P0KE47657 , 150: POKE 

47786,170: IFPEEK(713)=1THEN290 
RUN 



Table 2: GB3 CATALOG 



C1983DSRC#254 

248 FREE 

A 005 HELLO 

A 098 HELLO 1 1 

A006DAVIDINIT 

A 065 CHANGE INFORMATIONS 

T 001 PERIODS 

T 002 CHECK 

A 048 CREATE 3 

B 034 GRADE BOOK 1 1 



COMPirngT #66 



< Readers Data EXchanga < 



17 



Table 3: DOS Switching Subroutine 

on Pages $BA & $BC 
(See track $00, sector $04, byte $69) 



BA69 A9 AB 


LDA #$AB 


Change sync byte prior to 


BA6B 8D 4B B8 


STA $B84B 


data header to $AB 


BA6E A9 FF 


LDA #$FF 


Change ht & 2nd epilogue 


BA70 20 DF BC 


JSR $BCDF 


bytes to $FF 


BA73 20 EC BC 


JSR $BCEC 




BA76 A9 AA 


LDA #$AA 


Change 1st value in write 


BA78 8D 29 BA 


STA $BA29 


translate table to $AA 


BA7B 60 


RTS 


Return to caller 


BA7C 60 


RTS 




BA7D A9 FF 


LDA #$FF 


NormdiTf sync byte prior to 


BA7F 8D 4B B8 


STA $B84B 


data header to $FF 


BA82 A9 DE 


LDA #$DE 


Normaliije Ist epibgue 


BA84 20 DF BC 


JSR $BCDF 


byte to $DE 


BA87 A9 AA 


LDA #$AA 


Normalke 2nd epibgue 


BA89 20 EC BC 


JSR $BCEC 


byte to UA 


BA8C A9 96 


LDA //$96 


Normalize 1st value in write 


BA8E 8D 29 BA 


STA $BA29 


translate table to $96 


BA91 60 


RTS 


Return to caller 
(See Tm.S$06,B$DF) 


BCDF 8D AE BC 


STA $BCAE 


1st address epibgue to write 


BCE2 80 9E B8 


STA $B89E 


1st data epibgue to write 


BCE5 8D 35 B9 


STA $B935 


1st data epibgue to read 


BCE8 8D 91 B9 


STA $B991 


1st address epilogue to read 


BCEB 60 


RTS 


Return to caller 


BCEC 8D B3 BC 


STA $BCB3 


2nd address epibgue to write 


BCEF 8D A3 B8 


STA $B8A3 


2nd data epibgue to write 


BCF2 8D 3F B9 


STA $B93F 


2nd data epibgue to read 


BCF5 8D 9B B9 


STA $B99B 


2nd address epilogue to read 


BCF8 60 


RTS 


Return to caller 



Table 4: GRADE.BK.TXT 



HI MEM: 38400: HOME: NEW 

?CHR$(4)"L0ADHELL0'I I ,D"; :?(PEEK(43624)=1)+1 

20TEXT : HOME : VTAB12 : ? " 1 NSERT' GRADEBOOK' 1 1 1 ' D I SK' &' 

PRESS' RETURN" ; : GETK$ : HOME : VTAB12 : RETURN 
26?D$; "OPEN' PERIODS, L5":?D$; "READ' PERIODS" :FORI=0 
TO 8 : 1 NPUTPD ( I ) : NEXT : ?D$ ; "CLOSE' PER I ODS" : ONERR 
GOTO305 
29VTAB12: ?"N0' CLASS' PERIODS' ARE' ON' THIS'DISK" : ? : ? 
CHR$(7):F0RI=1 TO 3333:NEXT: IFPEEK{0)<>76 THEN 
POKE 43624, 1 : HOME :VTAB10:? "RETURN I NO' TO' THE' 

D I RECTORY... ":G0T011 
98IFC$="R" AND PEEK(0)<>76 THEN P0KE43624, 1 :G0T011 
395HOME 
SAVEHELLO' 1 1 
NEW 

LOADDAVID'INIT 
180?CHR$(4);"INITHELLO" 
184IFPEEK(0)<>76 THEN ?CHR$(7) :HOME:VTAB10:?"THE' 

DATA' D I SK' I S' READY' TO' ENTER' PER I ODS .":?:?: ? 

"RETURNING' TO' THE' DIRECTORY. . .":?D$;"RUNHELLO' 

II,D1" 
230?CHR$(4)"RUNHELLO'ir' 
SAVEDAVID'INIT 
NEW 

LOADCHANGE' INFORMATION' 3 
109 
20000HOME: IFPEEK(0)<>76 THEN VTAB10:?"RETURNING'TO' 

THE'D I RECTORY . . . " : P0KE43624 , 1 : GOTO20065 
20010VTAB12: ?" INSERT' GRADEBOOK' 1 1 1' DISK' &' PRESS' 

<RET>";:GETC$:?C$ 
60000HOME: IFPEEK(0)<>76 THEN VTAB10:? "RETURNING' TO' 

THE' DIRECTORY. . .":POKE43624,1:GOTO60010 
60001POKE-16368,0:VTAB12:?"INSERT' GRADEBOOK' III' 

DISK'&'PRESS'<RET>" ; :GETC$: ?C$ 
63556HOME : VTAB10 ; ?"WRONG'D I SK" : ? : ? " I NSERT'DATA'D I SK' 

&' PRESS' RETURN" ; :GETC$ : ?C$ :GOTO63550 
SAVECHANGE' INFORMATION' 3 
NEW 

LOADCREATE'3 

180 1 FPEEK(0) <>76 THEN P0KE43624 , 2 :GOTO360 
340 
3540POKE6 , : HOME : I FPEEK(0)<>76 THEN VTAB10 :? "RETURN 

I NG' TO' THE' D I RECTORY . . . " : P0KE43624 , 1 : ?D$ ; "RUN' 

HELLO' 1 1 " 
3560VTAB12:?" INSERT' GRADEBOOK' 1 1 1' DISK' &' PRESS' 

<RET>";:GETC$:?C$ 
38001 FPEEK(222)=8 THENVTAB8 : ?"THE'DRI VE'DOOR' IS'OPEN' 

OR" : ? : ?"THtS'DISK'IS'UNINITIALIZED! " : ? : ?"PLEASE' 



CORRECT' AND'PRESS'RETURN' " ; : GETK$ : ?K$ : CALL768 : 

POKESK,0:HOME:GOTO140 
SAVECREATE'3 
NEW 

10HOME:VTAB8 

20? "TO'ED I T' PARENT' LEHER' I NSERT'THE' BACKUP" 
25?"OF"'; : INVERSE:?"PARENT'LEnER"; :?"' IN'D";PEEK 

(43624);".": NORMAL 
30? : ? : ? " I NSERT' THE' D I SK' CONTA I N I NG' " ; : I NVERSE : ? 

"PARENT.TXT" :NORMAL 
35?"'IN'D";(PEEK(43624)=1)+1 
40? : ? : HTAB8 : ? "RRESS'THE'C-KEY'TO'CONT I NUE . " 
45? :HTAB8: ?"PRESS'<ESCAPE>'TO'EXIT. " 
50POKE-16368,0:B=PEEK(-16384) :POKE-16368,0: IFB=27 

THEN80 
55IFB<>27ANDB<>67THEN50 
60?CHR$(1) : ?CHR$(4) "EXECPARENT.TXT.D" ; (PEEK (43624) 

=1)+1 
70CALL976:GOTO60 
80HOME:VTAB8:HTAB12:INVERSE:?"THAT'S' ALL' FOLKS": 

NORMAL :TEXT 
RUN 



Table 5: PARENT.TXT 

NEW 

?CHR$(4)"L0ADPARENT'LETTER,D" ; : ?(PEEK(43624)=1)+1 

380IFK$="R"THENHOME:VTAB10:?"PLACE' GRADEBOOK' l-ll' 

D I SK' I N' DR I VE' 1 . " : VTABl 2 : ? " PRESS' ANY' KEY' TO' 

CONTINUE. . . " ; :GETK$: ?K$:P0KE43624, 1 : ?D$"RUN 

HELLO II" 
SAVEPARENT LETTER 
NEW 
10HOME : VTAB8 : ? "THE'BACKUPS'ARE'UNPROTECTED . ' I NSTALL' 

A" 
20? " FAST-DOS'ON'THE' PROGRAM'D I SK'TO'SPEED" 
30HTAB12: ?"DISK'OPERATIONS. " 
40VTAB14 : HTAB12 : 1 NVERSE : ? "THAT ' S'ALL'FOLKS" : NORMAL 

:TEXT 
RUN 



TABLE 6: BOOT STAGE 1 
(See track $00, sector $00, byte $01) 



Table 7: Disk check subroutine on page $BB 

(See track $00, sector $05. byte $00) 

(Disassembled from page $8B 

loads into page $BB) 



0801 A5 27 
0803 C9 09 
0805 D0 18 
0807 A5 2B 
0809 4A 
080A 4A 
080B 4A 
080C 4A 
080D 09 C0 
080F 85 3F 
0811 A9 5C 
0813 85 3E 

0815 18 

0816 AD FE 08 
0819 6D FF 08 
081C 8D FE 08 
081F AE FF 08 
0822 30 15 
0824 BD4D08 
0827 85 3D 
0829 CE FF 08 
082C AD FE 08 
082F 85 27 
0831 CE FE 08 
0834 A6 2B 
0836 6C 3E 00 
0839 EE FE 08 
083C EE FE 08 
083F 20 89 FE 

20 93 FE 
20 2F FB 



0842 
0845 



0848 A6 2B 
084A 6C FE I 



LDA $27 
CMP #$09 
BNE $08 IF 
LDA $2B 
LSR 
LSR 
LSR 
LSR 

ORA #$C0 
STA $3F 
LDA #$5C 
STA $3E 
CLC 

LDA $08FE 
ADC $08FF 
STA $08FE 
LDX $08FF 
BMI $0839 
LDA $084D,X 
STA $3D 
DEC $08FF 
LDA $08FE 
STA $27 
DEC $08FE 
LDX $2B 
JMP ($003E) 
INC $08FE 
INC $08FE 
JSR $FE89 
JSR $FE93 
JSR $FB2F 
LDX $2B 
JMP ($BBFE) 
BRK 



Standard Boot 1 Loader from 
$801 thru $849 



Indirect jump to $BBO0 

(Disk Check). Usually jumps thru 

$8FD to $B700 (Boot 2 Loader) 



A9FF 
8B02 85 D6 
8B04 BD8DC0 
8B07 A9 FF 
8B09 EA 
8B0A 30 05 
8B0C A2 Bl 
8B0E 4C F0 BB 
8B11 ADFDFF 
8B14 A9 00 
8B16 F0 05 
8B18 A2 B2 
8B1A 4C F0 BB 
8B1D BD8CC0 
8B20 A9 00 
8622 8D 00 02 
8B25 BD 8C C0 
8B28 10 FB 
8B2A C9 EB 
8B2C D0 F7 
8B2E BD 8C C0 
8B31 10 FB 
8B33 C9 D5 
8B35 D0 EE 
8B37 BD8CC0 
8B3A 10 FB 
8B3C C9 AA 
8B3E D0 E5 
8B40 A9 4C 
8B42 A0 00 
8B44 99 00 95 
8B47 88 
8B48 D0 FA 
8B4A CE 46 BB 
8B4D AD 46 BB 
8B50 C9 07 
8B52 D0 EC 
8B54 A9 18 
8856 8D 42 B9 
8B59 A9 0A 
8B5B 8D ED B7 
8B5E D0 05 
8B60 00 
8B61 02 
8B62 01 02 
8B64 06 
8B65 A9 00 
8B67 8D EC B7 
8B6A 8D F0 B7 
8B6D A9 40 
8B6F 8D Fl B7 
8B72 A9 01 
8B74 8D F4 B7 
8B77 8D F8 B7 
8B7A 8D EA B7 
8B7D 8E E9 B7 
8B80 8E F7 B7 
8B83 A0 6C 
8B85 8C 10 B9 
8B88 8C CE B8 
8B8B 8C D2 B8 
8B8E 88 
8B8F 8C 21 B9 
8B92 20 E7 BB 
8B95 A0 55 
8B97 B9 00 6C 
8B9A 99 00 5C 
8B9D 88 
8B9E 10 F7 
8BA0 AD 02 6B 
8BA3 85 06 
8BA5 20 E7 BB 
8BA8 AD 02 6B 
8BAB 85 07 
8BAD 20 E7 BB 
8BB0 AD 02 6B 
8BB3 85 08 
8BB5 A0 55 
8BB7 B9 00 6C 
8BBA D9 00 5C 



LDA #$FF 

STA $D6 

LDA $C08D,X 

LDA #$FF 

NOP 

BMI $8B11 

LDX mi 

JMP $BBF0 
LDA $FFFD 
LDA #$00 
BEQ $8B1D 
LDX #$B2 
JMP $BBF0 
LDA $C08C,X 
LDA #$00 
STA $0200 
LDA $C08C,X 
BPL $8B25 
CMP #$EB 
BNE $8B25 
LDA $C08C,X 
BPL $8B2E 
CMP #$D5 
BNE $8B25 
LDA $C08C,X 
BPL $8B37 
CMP #$AA 
BNE $8B25 
LDA #$4C 
LDY #$00 
STA $9500, Y 
DEY 

BNE $8B44 
DEC $BB46 
LDA $BB46 
CMP #$07 
BNE $8B40 
LDA #$18 
STA $8942 
LDA #$0A 
STA $B7ED 
BNE $8B65 
BRK 

777 

ORA ($02,X) 

777 

LDA #$00 
STA $B7EC 
STA $B7F0 
LDA #$40 
STA $B7F1 
LDA #$01 
STA $B7F4 
STA $B7F8 
STA $B7EA 
STX $B7E9 
STX $B7F7 
LDY #$6C 
STY $B910 
STY $B8CE 
STY $B8D2 
DEY 

STY $B921 
JSR $BBE7 
LDY #$55 
LDA $6C00,Y 
STA $5C00,Y 
DEY 

BPL $8B97 
LDA $6B02 
STA $06 
JSR $BBE7 
LDA $6602 
STA $07 
JSR $6BE7 
LDA $6602 
STA $08 
LDY #$55 
LDA $6C00,Y 
CMP $5C00,Y 



Set RUN Flag 



Find$EB 



Find$D5 



Find$AA 



Fill pages $08-W5 with $4C 

Disable DOS read error check 
Setup lOB to seek sector $0A 



Setup lOB to seek track 58C 

Buffer address Lo-byte 

Buffer address Hi-byte 

Set CMD=1 (Read) 

Set drive no. found to 1 

Set drive no. sought to 1 

Sot no. ($60 for slot ±6) 

Slot no. found 



Change primary DOS buffer to 

page $6B and secondary 

buffer to $6C00-$6C55 

Jump to RWTS & make 1st read 



Move $6C00-$6C55 to 
$5C0O-5C55 (secondary buffer) 



Jump to RWTS & make 2nd read 



Jump to RWTS & make 3rd read 



Compare $5CO0-$5C55 with 
$6C0(^$6C55 
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8BBD D0 2F 
8BBF 88 
8BC0 10 F5 
8BC2 A5 06 
8BC4 C5 07 
8BC6 D0 04 
8BC8 C5 08 
8BCA F0 17 
8BCC A9 38 
8BCE 8D 42 B9 
86D1 A0 BC 
8BD3 8C 10 Bg 
8BD6 8C CE B8 
8BD9 8C D2 B8 
8BDC 88 
8BDD 8C 21 B9 
8BE0 4C 00 B7 
8BE3 4C 54 BB 
8BE6 09 
8BE7 A9 87 
8BE9 A0 E8 
8BEB 4C B5 B7 
8BEE A2 B3 
8BF0 20 58 FC 
8BF3 20 2D FF 
8BF6 8E 03 04 
8BF9 4C 5B B7 
8BFC 60 
8BFD 02 
8BFE 00 
8BFF BB 



BNE $8BEE 
DEY 

BPL $8BB7 
LDA $06 
CMP $07 
BNE $8BCC 
CMP $08 
BEQ $8BE3 
LDA #$38 
STA $B942 
LDY //$BC 
STY $B910 
STY $B8CE 
STY $B8D2 
DEY 

STY $B921 
JMP $B700 
JHP $BB54 

777 

LDA #$B7 
LDY #$E8 
JMP $B7B5 
LDX #$B3 
JSR $FC58 
JSR $FF2D 
STX $0403 
JMP $B75B 
RTS 

777 

BRK 

777 



If$6C00,Y<>$SC00,Y, 
tdx failure path 



If$06<>$07.take 

good path 

If$O6=$07=$08.repeat M 

check thru $8BE3 

Restore DOS read error 

checks 



Normalize primary and 
second buffer locations 



Exit to Boot 2 Loader 
Repeat &k check 

lOB address Hi-byte 

lOB address Lo-byte 

CallRWTS 

Clear screen 
Priia 'ERR' 

Sets reset pointer to $W52 

Reboots via $0000 ($C600) 

-Return to caller 



Table 8: Gradebook III controller 



Controller 



1000 REM GRADEBOOK 1 1 1 CONTROLLER 

1002 REM SCHOOLHOUSE 

1003 HOME : VTAB 8: PRINT "THIS'CONTROLLER' IS'SET'TO' 
BACKUP* GRADE-" 

1004 PRINT "BOOK'1 1 1 /SIDEn/PARENrLETTER/SIDE'2" 

1005 PRINT " IS'UNPROTECTED/A"BACKUP'0F'SIDE'2' IS" 

1006 PRINT "NEEDED'TO'EDIT'CALLS'TO'MODIFIED'DOS." 

1007 PRINT : HTAB 8: PRINT "PRESS' THE' C-KEY' TO' 
CONTINUE." 

1008 PRINT : HTAB 8: PRINT "PRESS'<ESCAPE>'TO'EXIT." 
1009 POKE -16368,0:B = PEEK (-16384): POKE -16368,0: 

IF B = 27 THEN END 
1010 I F B <> 27 AND B <> 67 THEN 1009 
1015 PRINT CHR$ (1): HOME :TK = 0:LT = 35:ST= 15:LS = 

15:CD = WR:FAST = 1: POKE 775,96 
1020 POKE 47657,170: POKE 47786,0 
1025 GOSUB 490: RESTORE : GOSUB170: GOSUB610:T1 = TK:TK 

= T1 + 6:GOSUB310:TK = T1 
1030 GOSUB 490: GOSUB 230: POKE 47657,150: POKE 

47786,170: GOSUB 610 
1032 IFPEEK(TRK) =35 THEN 1050 
1034 I F PEEK (TRK) = 1 AND LT = 1 THEN 1055 
1040 TK = PEEK (TRK) : ST = PEEK (SCT) : GOTO 1020 

1050 I F PEEK (3208) = 49 AND PEEK (3209) = 53 THEN POKE 
3208,48: POKE 3209,57: GOTO 1054 

1051 HOME : VTAB 8: PRINT "THE'PATCH'FOR'10'SECTORS'HAS' 
FAILED." 

1052 PRINT "LINE'#340'MUST'BE'EDITED'TO'CHANGE'15" 

1053 PRINT "TO'9.'MAKE'EDIT'THEN'TYPE:'RUN1054<RTN>" 
: END 

1054 HOME :TK = 0:LT = 1:ST = 9:LS = 9:CD = WR:MB = 109: 

POKE 900,9: GOTO 1025 
1055 HOME : VTAB 8: PRINT "INSERT'THE'DISK'CONTAINING' 

" ; : INVERSE : PRINT " GRADE. BK, TXT" : NORMAL 
1060 PR I NT : HTAB 6 : PR I NT " I N'THE'SOURCE'DR I VE , 'DR I VE' 

"iDl;"." 
1070 VTAB 14: HTAB 8: INVERSE : PRINT "PRESS'ANY'KEY'TO' 

CONTINUE." : NORMAL 
1080 WAIT -16384,128 
1100 PRINT CHR$ (1): PRINT CHR$ (4) 

"EXECGRADE.BK,TXT,D" ;D1 
1110 PRINT CHR$ (7): CALL 976: GOTO 1100 
1200 DATA 255,255,255,255 
1210 DATA 25'CHANGES 

1220 DATA 0,0, 74, 76, 0,0, 75, 0,0, 0,76, 183 
1230 DATA 0,2,62,255,0,2,74,72,0,2,75,104,0,2,76, 

32,0,2,77,185,0,2,78,184,0,2,158,222,0,2, 

163,170 



1240 DATA 0,3,53,222,0,3,63,170,0,3,145,222,0,3, 

155,170 
1250 DATA0, 4, 41, 150, 0,4, 170, 170 
1260 DATA0, 6, 174, 222, 0,6, 179, 170 
1270 DATA 17,0,64,255,17,0,65,224 
1280 DATA 0,1, 101, 76, 0,1, 102, 191, 0,1, 103, 157 
1290 DATA 0,13,49,0 

Checksums 



Vince Ruggiano 
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1000 
1002 
1003 
1004 
1005 
1006 
1007 
1008 
1009 
1010 
1015 
1020 
1025 



$356B 
$724C 
$CCE2 
$DB2E 
$3C15 
$864C 
$8055 
$67C2 
$9430 
$4069 
$C3EC 
$97D9 
$B5EB 



1030 - $F07F 
1032 - $E874 
1034 - $507D 
1040 - $201 A 

1050 - $6EDA 

1051 - $E194 

1052 - $A0C1 

1053 - $497F 

1054 - $CDE0 

1055 - $4184 
1060 - $C837 
1070 - $A61F 
1080 - $136E 



1100 - $1A40 
1110 - $7D74 
1200 - $CA3D 
1210 - $E526 
1220 - $2ACD 
1230 - $4C21 
1240 - $2E06 
1250 - $05D9 
1260 - $E489 
1270 - $9BD7 
1280 - $7A41 
1290 - $20D7 



Betta B. Goode 



Ilgs Softkey for.. 



The Last Ninja GS 



Activision 



The Last Ninja GS is a karate action game which 
involves skill with the joystick or keyboard, as well as skill 
in collecting strength points and weaponry. It can be copied 
quite easily by any of the standard copy programs for the 
3 ^A " disk. But, after you have safely stored your Master 
Disk and sat down comfortably at your computer, ready 
to meet the challenges in The Last Ninja, you'll find that 
you must dig your Master copy out of its place of refuge, 
because you will not be able to play the program without 
inserting the Master Disk when prompted. This upset me, 
more than just a little. I do not like to expose my Master 
disks to possible damage. So, I set about examining the 
code on the disk. 

Deprotecting my copy involved inspecting the code 
in the file named "NINJA.SYS16" to discover where the 
subroutine was that required that I have my Master near 
by. I found it after only a short search. If your copy is 
like mine, you should have no problem following these 
steps. 

I 1 I Copy your original onto another 3 ^A " disk. 

I 2 I Use your favorite sector editor and search the disk 
for 22 A8 00 El 22 00. 

It occured only once on mine at Block $CD, beginning 
at byte IBO. This instruction tells the program to Jump 
Long to a subroutine (JSL) at $E1/00A8 and read a block. 
Easily defeated! 

Immediately following this sequence, you should find 
Fl C4 00 00 90 C0. The culprit is the BCC (branch if carry 
clear) to $117C, the 90 C0. Ifthe carry is clear, the program 
will branch to the "Insert Master" routine. There are two 
instructions that branch to this routine, the second is a BNE 
(branch if not equal) after an instruction to compare. All 
we have to do to defeat the second is to "leap-frog" right 
over it to where the program continues as normal. This 
occurs at $1 1D2. Consequently, a BRA (Branch Always) 
instruction will do the trick. 

[T] Change the 90 C0 to 80 16. On my disk this occurs at 
bytes $1BA and $1BB. 

NOTE: If the protection lies elsewhere on your copy, you 
should still be able to modify the above to defeat the 
protection. On my disk the instruction to continue as 
normal is a BEQ (Branch if Equal) instruction within 12 
bytes after the 90 C0 shown above. You will merely have 
to change the "16", which follows the BRA (80) 
instruction, to match the address referenced by the BEQ 
instruction found on your disk. 

I 4 I Write the changes to your disk. 

Store your original in a safe place and use the copy 
to meet the challenges that lay ahead. 



MUUkens Pre-writing Series 
Branching-BraiDstorming-NutsbeUing 



Milliken 



Larry Rando's softkey for Discovery! (COMPUTIST 
#39) gave me the impetus for this softkey. 

[T]Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and epilog errors and 
use COPY A to copy the disks. 

POKE 47426,24 
RUN COPYA 

I 3 I Make the following sector edits to the copy you just 
made. 

Irk Set Byte(s) From To 



$00 $02 9E 
$00 $03 35 
$00 $03 91 



DF 
DF 
DF 



DE 
DE 
DE 



RH Search the disks for 99 AD and change to 84 9D. I found 
these bytes at different locations on each disk. 

[Tl Search the disks for 4C 00 C6 and change to EA EA EA. 

Make sure to write all edits to your disk! Your disks 
should now be copyable with normal COPYA (from DOS 
3.3). For some reason copies made with Copy n Plus 
"Disk Copy" did not run. Only COPYA copies work. 
If anyone knows why this phenomenom is occurring please 
let me know. Put your originals in a safe place and enjoy! 



Softkey for., 



Math Shop 

Scholastic 



I 1 I Copy both sides of Math Shop diskette using any disk 
copier. 

[T] Delete the files "PRODOS" and "MATH. 
SYSTEM" from side 1 of the diskette. < 

I 3 I Copy a PRODOS system file from another source to 
side 1 of the diskette. I used the PRODOS file from Copy 
n Plus. 

I 4 I Use a sector editor to search side 1 for 4C 00 C6 and 
change to EA EA EA. My copy had these bytes on track 10. 

I 5 I Search side 1 for 1 ED and change to EA EA. My copy 
had these bytes on track 3. 

Make sure to write all sector edits back to the disk! 



Mike Maginnis 



First of all, I would like to complement you on an 
excellent magazine that has proved invaluable more times 
than I can count. I plan to keep subscribing and hope to 
see many more issues in the ftiture. 

(2) I have a problem with Michael Morton's 
Alternate Reality Character Editor. I am an avid advenmre 
gamer and I thought a little help with this one would be 
nice. Unfortunately, even after changing the '#' signs to 
' " ', the editor still does strange things. Usually, it won't 
read the character disk, and crashes. On the few occasions 
it does read, the names are trashed and I can't get to the 
stats editor menu. Can anyone help me on this one? 

eg) Also, in response to COMPUTIST's question 
about good BBS's, GBBS and ProGBBS are excellent for 
the Apple. I also have a public domain program called 
ABBS (Apple BBS), but I can't seem to get this to work. 
The drive accesses the boot disk for about a minute before 
stopping and hanging. Can anyone give me a suggestion 
for this? 

C2) Next, I have a copy of Copy 11+ v8.2. When 
I go to Bit Copy any disk that's not an original, I get this 
message about how I should be using an original disk for 
copying. If I run it with an original, I don't get this 
message. My question is, how does the program know 
whether or not the disk is an original? I have tried write 
protecting copies and using un-write protected originals 
and it still seems to know whether or not I'm using an 
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original. Can anyone provide some insight as to how they 
do this? 

<2) Finally, I recently purchased a copy of 
Wasteland by Electronic Arts. This game is excellent and 
for anyone into futuristic/Sci-fi fantasy RPG's on the 
computer, I heartily suggest this classic. Unfortunately, 
but predictably, this program is protected. Bit copies of 
the program failed miserably, rebooting after several 
seconds in an endless loop. In COMPUTIST #62 
(December) and I saw the softkey for Deathlord, also by 
Electronic Arts. I am not a great player in the game of 
software deprotection, but I know enough to be able to 
at least figure out most protection schemes and use 
COMPUTIST to help me from there. From Blain 
Johnson's letter, as near as I can tell with a nibble editor. 
Wasteland's protection is identical to Deathlord's (1 
readable sector on track $0, 10 4&4 sectors, D5 AA + 
track, sector & checksum bytes headers, no ej^ogues (that 
I could find), D5 9C + 342 encoded bytes data prolog, 
C9 data epilogue). Unforunately, when I tried his method, 
the drive would format the blank disk and then crash with 
a PROGRAM TOO LARGE error and stop at line 200. 
After some experimentation, I ran the program, let it crash, 
removed lines 10 to 30 from the DEATHLORD. HAS 
program and ran it again. This time, the program got 
further, reading for sevral seconds from the Wasteland 
disk before again crashing with a PROGRAM TOO 
LARGE error, stopping with line 530. Can anyone offer 
a hint? 

<2> Also, does anyone know where I can obtain 
a copy of Beneath Apple DOS? 

* Order the book direct! See page 28, 1st column, 2nd 
paragraph RDEXed 

Playing Tip for...' 



Wasteland 

Electronic Arts 



i 



Beware reading any furttier, too many dead givaways. 
RDEXed 

• The canteen is a must in the desert, without it you will 
die of heat exhaustion. 

• The cave in Highpool (which I never did find) is useless 
- don't waste time looking for it 

• It's good to have high Lockpicking, Medic and 
Perception abilities. 

• The answers to the riddler's questions in Scott's Bar 
in Quartz are TOAST, R, and URABUTLN 

• The password to the courthouse it MUERTE. A passage 
leads from the Stagecoach Inn to the Courthouse if you 
want to save time. 

• Most bums want snake squeezins 

• The combination to Ugly's safe is Hewey, Dewey and 
Louie. 

• Ugly's hideout password it KAPUT 

• The Club Acapulco's password is ACAPULCO 

• The launch code is MOTEKIM 

• Only carry the basics. It's easy to fill up your inventory 
with useless items and end up not being able to get vital 
equipment in a time of dire need (I speak from experience) 

• The Black Market's Password is CRETIN 

• Fat Freddy's Password is BIRD 

• Faran Brygo's Password is KESTREL 

• Fat Freddy doesn't like to be told 'NO' 

• FARAN BRYGO sends you to Charmaine, but don't 
get too close to her. 

• EINSTEIN is the Holy One 

• YES, you did see the great glow 

• The sewers are the most difficult part of the game; you 
meet up with countless killer androids. Come with a full 
stock of ammunition and powerful weapons. 

• Put pieces found in the Sewers into Max until he comes 
to life. 

• The power controller in the northeast most room is 
missing a converter. 

• Go to the room with the power controller and cut the 
power long enough to get through the energy fields into 
the power converter room. Do it to get out again (you need 
to split the party up for this). 

• Have a person with high IQ train in the helicopter 
simulator 

• Collect and keep all secpasses (there should be four: 1 , 



3, A, & 7) 

• secpass 7 allows entry to The Underground (Finster's 
Chambers) 

• The password for the elevator is PROTEUS 

• connect the Cyber helmet to the Mindlink 

• Finster is an android 

• The answer to get out of the first arena is 32, the second 
is 512, the third is 20. 

• The next riddle's answer is FINSTER 

• You need luck to get out of the showers 

• The fifth arena's answer is NOTHING 

• ICEBERG is next 

• Don't leave here until you have secpass B. Remember 
everything you do here is permanent. 

• Fight your way into the Guardian's Citadel to get the 
Quasar Key. 

• The Guardian's Outer Sanctum has the Nova and 
Blackstar Keys. 

• Use perception to find the Blackstar key 

• The Inner Sanctum has extremely powerftd weapons 
and the access code to this area is ROSEBUD. 

• The password to Savage Village is REDHAWK and 
that's who the Junkmaster wants. 

• Use the helicopter in the Inner Sanctum to fly to Base 
Conchise (use the person who you trained to fly the 
chopper). 

• Don't mess with the computer on level 1 of Base 
Conchise. 

• Vax will help you destroy the robot making machines 
on Level 2 of Base Conchise 

• Level 3 of Base Conchise is riddled with land mines 

• All the computers on level 3 must be turned on 

• In the four rooms of the final Base Conchise, mm the 
keys in this order: Blackstar, Nova, Pulsar, Quasar. The 
keys should be in these rooms, respectively: Blackstar - 
Reactor Core Room, Nova - Robot Maintenance Room, 
Pulsar - Security Electtonics, Quasar - OSHA. The final 
color sequence is red - nuclear reactor, yellow - security 
elecfronics, green - OHSA, and blue - robot maintenance. 
Waste no time in getting as far away from here as possible. 



Trk Set Byte(s) From 



To 



I.B. Darn 
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MECC 1988-89 Copy System 

MECC 



■ Requirements 

D Any Apple n computer w/64K 

D Super lOB w/Standard.Con (from Starter Kit) 

D Sector editor 

D One blank disk 

The MECC Copy System is a fast copy which will 
utilize the extra memory of the computer. Copies can be 
produced in about 9 seconds. The Copy System will make 
copies of any MECC disks for which they give permission. 
The Copy Sytem will not duplicate itself, but will duplicate 
all normal Apple disks, plus some protected programs not 
produced by MECC. 

The MECC disk uses two copy protection schemes. 
The first is by altering the 3rd Address Marker from 96 
to FF and the 3rd Data Marker from AD to FE on ttacks $01 
through $22. The second scheme is a disk signature check 
on track $02, sector $02. A good bit copier set for Nibble 
Count will copy the original disk, but that is not the 
purpose of this article. 

To produce a normalized COPYAable disk: 

[TjBoot your Starter Kit disk. 

I 2 I Insert a blank disk into the drive and initialize it. 

I 3 I Load Super lOB and merge the Standard Controller. 



LOAD SUPER lOB 
EXEC STANDARD>CON 
POKE 47468,0 
POKE 47358.0 
RUN 



ignore third addr byte 
ignore third data mark byte. 



Do not re-format the disk when prompted. 

I 4 I Use a Sector Editor to patch frack $(X) on the disk 
you just made. 



$00$07$8A-8B A9FE 


A9AD 


$08$29-2A C9FE 


C9AD 


$97-98 C9FF 


C9 96 


$0B$B1-B2 A9FF 


A9 96 



The disk is now bootable, but will not run because 
of the nibble count/signature check on track $02, sector 
$02. 

I 5 I To disable the nibble count/signature check, perform 
the following sector edits: 

Trk Set Byte(s) From To 



$02$02$0C-0D D0 11 

$02$02$0E-0F A6FE 

$02 $02 $16-17 D0 07 

$02 $02 $18-19 A6FE 



EAEA 
A9 03 
30 FD 
A6FF 



You should now have another fast disk copier to add 
to your collection. Thanks to RDEX/COMPUTIST. 
Perhaps one of you readers will be able to break the 
program from the disk as a stand alone program. 



Softkey for... 



Label Utility 

MECC 



■ Requirements 

D Apple He or Apple lie computer 

D Super lOB w/Standard.Con (from Starter Kit) 

D Sector Editor 

D One blank disk 

This MECC Disk is on the reverse side of the MECC 
Copy System. The disk is only protected by a change in 
the 3rd address mark byte from 96 to FF and the 3rd data 
mark byte from AD to FE on ti-acks $01 to $22. 

To produce a normalized COPYAable disk: 

nrJBoot your Starter Kit disk. 

I 2 I Insert a blank disk into the drive and initialize it. 

I 3 I Load Super lOB and merge the Standard Controller. 

LOAD SUPER lOB 
EXEC STANDARD.CON 



POKE 47468,0 
POKE 47358,0 
RUN 



ignore third addr byte 
ignore third data mark byte. 



Do not re-format the disk when prompted. 

I 4 I Use a Sector Editor to patch track $00 on the disk 
you just made. 

Trk Set Byte(s) From To 



$00 $0C $86-87 A9FE 

$0B$A2-A3 C9FE 

$1C-1D C9FF 


A9AD 
C9AD 
C9 96 



You should now have a deprotected COPYAable disk. 
Thanks to RDEX/COMPUTIST. 



Rick Davis 



Softkey for... 



Snaggle 

Broderbund 



[T]Boot your Starter Kit disk. (Or DOS 3.3 System 
Master.) 

I 2 I Insert a blank disk in the drive and init a Slave disk. 

INIT HELLO 
DELETE HELLO 

I 3 I Enter the monitor. 

CALL-151 

9600<C600.C6FFM Move Disk II boot code into RAM. 

96FA:98 Make it jump to $9801 instead of boot 1 at $0801. 

9801:2C E8 CO 4C 59 FF To turn the drive off and jump to reset. 
9600G Run the changed code. 

I 4 I Move boot 1 up to $9800 so we can modify it. 
9800<800.8FFM 
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9805:98 Make the program move our code instead of boot 1. 

9843:93 Make the program exit to our code. 

9301:2C E8 CO 4C 59 FF Turn disk drive off and jump to reset. 
9600G Run the code. 

I 5 I Move Boot 2 up to where we can modify it. 

9300<300.3FFM 

9343:4C 00 90 Jump to our code. 

9000:A5 3E C9 5D DO 03 4C 5D 

9008:02 2C E8 CO 4C 59 FF This code looks at the current 

pointer and checks it against $5D. If its not equal to $5D, it 
returns to Boot 2. If it is equal to $5D, it wiU stop the disk 
drive and goto RESET. 

9600G start the code- 

[6] List the first instruction at $B742. 

B742L 

You should see: 

B742- 20 00 4A JSR $4A00 

This is the start of the routine that does the title page. 

[T]List the instraction at $B75F. 

B75FL 

You should see: 
B75F- 4C 00 50 JMP$5000 

This is the entry point of the main program. 

I 8 I Modify a unused section of Boot 1 to stop the drive 
and goto RESET. 

9844:2C E8 CO 4C 59 FF 

9009:A9 44 8D 60 B7 A9 02 8D 61 B7 4C 00 B7 Change the 

jump to the main program to jump to $0244. (The location 

where Boot 1 is moved to). 
9600G Run the code 

I 9 I Move the program code down to an area where it 
won't be overwritten. 

2000<5000.AAFFM 



10 Put the slave disk in the drive and boot it. 



C600G 

I 111 Go into the monitor and enter a short move routine 
to restore the program to its original location, and jump 
to the start of it. 

CALL-151 

1FOO:AO 00 B9 00 7A 99 00 AA 
1F08:C8 DO F7 CE 04 IF CE 07 
1F10:1F AD 04 IF C9 IF DO E8 
1F18:4C 00 50 

I 12| Save the entire program to disk. 
BSAVE SNOGGLE, A$1F00, L$5BFF 

You now have a BRUN'able file 94 sectors long. 
Softkey for... 



Alien Rain 
Demon Derby 

Broderbund 



The above procedure will also work for Broderbund's 
Alien Rain and Demon Derby with the following 
modifications. 

Skip steps 6 and 7, as locations are different. 

Modify the second Une of step 8 to. 

9009:A9 44 8D 58 B7 A9 02 8D 59 B7 4C 00 B7 

Skip step 9. 

For Ahen Rain, skip Step 1 1 . For Demon Derby only, 
change step 11 to. 

1000:4C 00 70 

In step 12, for Alein Rain type. 
BSAVE ALIEN RAIN, A$1000, L$67FF 

Or for Demon Derby, type. 

BSAVE DEMON DERBY, A$1000, L$67FF 

Now Alien Rain and Demon Derby are fully 
deprotected. 



Gary Kowalski 



Shape Tables? Scott Ernest from COMPUTIST #62 



is still using shape tables? I haven't heard of them for 
years. However, I shouldn't scoff since that's where I 
started when I was prognunming my Apple n+ back in 
1982. I guess vector shapes are the easiest to deal with 
from Applesoft. 

The "Apple n User's Guide", from McGraw-Hill 
was my guide, however I don't know if the current edition 
kept the shape table info or not. But shame on the RDEXed 
for not knowing that CORE #1 was a special issue on 
graphics and is still available from Computist as a back 
issue. CORE #1 explains shape tables and other graphics 
basics. 

If Scott or any other reader would like a shape table 
editor, they can have "Shape Table Manager' ' that I wrote 
years ago for only $10. The program allows you to create 
vector shapes on-screen and save them. Shape tables can 
be built from a library of vector shapes you build. 

For more advanced graphic technics (assembly 
language knowledge required) see Nibble Magazine back 
issues "Graphics Workshop " series 1984-1985 for an 
excellent discussion of block shapes. 
Gary Kowalski 
414 W. Russell Ave 
Santa Ana, Ca 92707 



Bob Colbert 



Laser 128 - The Dream Machine! 



I have been cracking software now for about 4 years, 
but I never owned a computer until about 2 years ago. 
My first experience at cracking was at my high school, 
my teacher had a couple of disks he needed copied. I think 
the first was the Disk Repair Kit, and if I remember 
correctly, I Bfiled it. After graduation though, I didn't have 
a computer to work on. Then my brother got an Apple 
He Enhanced, and I thought it was the greatest thing since 
sliced bread. 

I was so impressed with the Apple computer, that I 
wanted one of my own. When I priced the Apple series, 
I lost all faith. $1200 for a good system? Then came along 
the Laser series of computers, and I was quick to pick one 
up for $400. 

Bringing it home,I remember hoping that all of my 
software would work on it. After testing it out, I found 
that only about 2 % didn't work! And later on I was able 
to make these work (maybe in a different letter). 

It wasn't until about 8 months ago though that I fell 
in love with it. Here are some features that you may and 
may not know of, which I will explain later. 

•Non Maskable Interrupt built in. 

•Super Hi-resolution (no I don't mean Double Hi-res, I 

MEAN Super Hi-res!) 

•Double the ROM space of the Apple lie 

•Ability to change the border color 

•Softswitch to turn off video totally 

Non Maskable Inteirupt 

I actually found this out from an old issue of 
COMPUTIST. Pressing CTRL-M-reset (or CTRL- 
RETURN-reset), will break into the monitor in any 
program, but contrary to past articles, pressing it again 
will not get you back into the program, the only time that 
will happen, is if you break into the monitor and the reset 
vector is set for the program, pressing Breset jumps to 
the beginning of the program ^E. Copy n Plus). 

A This is not actually a Non Maskable Interrupt. It is a RESET 
routine that looks at the keyboard. If the RETURN key is 
pressed then the RESET routine exits to the monitor, otherwise, 
it performs a normal RESET RDEXed 

Super Hi-resolution 

I found this one out last night. Enter the monitor. 

CaU-151 

C025 

C027 

C050 

C052 

C054 

C057 

C00D:00 



C05E:00 

You should now see Super (Quadruple) Hi-res. 
Double hi-res screen 1 is on top, double hi-res screen 2 
is on bottom. You can also do this without being in the 
double hi-res mode, where hi-res screen 1 is on top and 
hi-res screen 2 is on bottom, which is also 'double high- 
res', but in a different maimer. 

The softswitches are C025 and C027, C025 makes the 
characters on the screen a little fiizzy, then C027 puts the 
new mode on. C024 turns C025 off and C026 turns C027 
off. 

This is very interesting when used to play a game, 
you can see both hi-res or double hi-res screens at the same 
time; just do softswitches C025 and C027, then reboot 
using 6 0P, no game turns these switches off since they 
do not know they are there. 

Also, storing different values at $C023 gives different 
shades of Isorder (they may be color, but I only have a 
green screen). And accessing $C02F toggles the video 
output of the computer on or off! 

Double the ROM space! 

If you turn the Laset over, you will find a door. 
Opening it will reveal an EPROM (Erasable 
Programmable Read Only Memory). This chip is the 
Lasers ROM code from $COOO-$FFFF. Further inspection 
will reveal that the chip is a 27x256, which is 32K, but 
the Apple has only 16K of ROM space. Well I figured 
out how to access this extra space with softswitches. Let 
me make a map of the chip memory and the computer 
memory. 

chip memory Laser memory 



$800-$FFF 
$1000-$1FFF 
$2000-$2FFF 
$3000-$3FFF 
$4000-$47FF 
^$4800-$4FFF 
$5800-$5FFF 
$6800-$6FFF 
$7800-$7FFF 



$C800 bank 
$DOOO-$DFFF BANK 1 
$EOOO-$EFFF 
$FOOO-$FFFF 
$C000-$C7FF 
$C800 bank 1 
$C800 bank 2 
$C800 bank 3 
$C800 bank 4 



You can switch banks 1-4 into the $C800 area by 
doing the following softswitches... 



CFFF 
ClOO 
CFFF 
C200 
CFFF 
C300 
CFFF 
C600 
ClOO 
CFFF 
C600 
C200 



turns off cm area 
selects bank 1 

selects bank 2 

selects bank 3 (normal bank) 

selects bank 4 

selects bank 5 

When you switch these in however, you can not list 
the banks from the monitor, since the monitor turns them 
off when listing. But, if you have the LISA assembler, 
you can boot it up and type BRK, which allows you to 
be in the LISA machine language monitor, and this monitor 
does not reset the softswitches, so you can view the code. 

Try this... 

CFFF 
ClOO 
CADEG 

You should now get the port configuration program 
built into the Laser! 

Modified ROMs 

I have modified my ROM to include utilities for 
cracking. Here is a list of features that I have added. . . 

• Auto boot trace: When T is pressed upon booting, the 
computer will display the track, sector, and address of the 
code being loaded using the ROM read routine. Then you 
can proceed to view the text or hi-res screens, or continue 
tracing the program! 

• Auxread and Auxwrite: Using the format 
xxxx<yyyy.zzzzW, you can move to location x, in the 
upper 64k, the block y to z, in the lower 64k. Also using 
the format xxxx<yyyy.zzzzR, you can move to location 
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X, in lower memory, and the block y to z, in upper 
memory. 

• Textview: Using the fonnat 3000T, you can view $200 
bytes of text from $3000 on. Pressing T from there on 
continues the process, so the next time you enter T you 
would see from $3200 on. 

• I also have made it so that pressing "Ctrl-Closed 
triangle-Reset" jumps to memory location $2000. 1 don't 
know why, but I was bored. 

All of this is done without removing a single function 
from the Laser! If you removed the port configuration 
program, you would have $800 bytes (2K) of totally free 
space to play with, and you could even swap ROMs. I 
am considering writing a ROM for nothing else but 
Cracking. I wiU have to see what happens. 

If anyone would like to contact me, feel free to drop 
me a letter. I am considering selling modified Laser 
ROMs, but do not know what the legal implications are. 
If I did, it would not be an outrageous price, maybe 
$35-$40. 



Chris Willis 



A.P.T.for... 



Roadwar2000 

SSI 



The following are just a few item locations in Roadwar 
2000 but they are the most useful to me. A sector editor 
is required, as well as your save game disk. The items 
are on track $03, sector $0B. 



BYTE 


WHAT IT IS 


37 


Number of vehicles 


38-39 


Food 


3A-3B 


Tires 


3C-3D 


Fuel 


3E-3F 


Ammo 


40-41 


Guns 


53-53 


Medical 



Z There is some disparity in this data and the more extensive 
data given by Aaron Schoeffler in COMPUTIST #57. Perhaps 
we are talking about two different versions. Here's a peek at 
some of Aaron's data: 



Name of gang 


$23-26 


Food 


$39-3A 


Tires 


$3B-3C 


Fuel 


$3D-3E 


Ammo 


$3F-40 


Guns 


$41-42 


Medical supplies 


$53 



RDEXed 



Scott IVI. Simon 



Super COPYA 1.1 



COPYA from Apple has been and still is a great 
program. This program has stood the test of time, been 
modified into COPYB, and Advanced Copy A. Anyone 
who has been kracking for quite a while has COPYA 
always near his computer. Ready to poke those DOS 
changes and get that new program into a normal format. 
Who would have known originally that COPYA would 
be so well used and easily modified. 

For all the newcomers, just look in any issue of 
COMPUTIST and you will see kracks for half of the 
programs that use COPYA in some form or fashion. A 
few article's have been printed showing all those great 
poke's and machine language changes to modify DOS 
3.3's RWTS. 

What makes COPYA so great is it's ability to be able 
to copy most disks in what ever format they are in, like 
PRODOS, DOS 3.3, PASCAL, SOS, and even some 
modified DOS's too. So if you are new to the computing 
scene and don't have COPYA, then stop by your local 
users group or friend and get it. 

This Super COPYA 1 . 1 program has been on my mind 
for a number of months now. I guess what inspired the 
need for it was the constant jumping into BASIC and back 
and forth to get all the pokes into COPYA so I could copy 



a disk into normal format. It always seems that I can never 
remember all those poke's and besides I hate having to 
look them up. So, I said, why not develop a menu screen 
which pokes all those things with a press of the key. Even 
better was the ability to pick and choose the ones I wanted 
to use. Well, diat is what Super COPYA 1 . 1 is all about. 

Designing the menu screen was easy. Getting the 
codes poked in was done with simple pokes laid out by 
the menu. The menu gives you the ability to pick and 
choose which changes to the DOS RWTS you want make. 
I do not recommend more than 3 changes to the RWTS. 
WhUe it is possible and I have made 5 changes or more 
to DOS at a time. Remember, when you poke changes 
to the RWTS, it is possible to poke so many changes that 
the DOS RWTS will not be able to tell where a track or 
sector starts. So go ahead and experiment. But stick to 
the basic rule of three. 

One problem I encountered when first making the 
program was that DOS constantly unhooked itself when 
it loaded using the original COPYA method. A simple 
hello loader was created and, I might add, a technique used 
for creating a text file with BASIC commands written to 
a text file and then EXEC'd. For beginners to BASIC 
programming, this is an easy technique for entering DOS 
commands from within a running program. A simple way 
you can load a lot of programs in fast. This loads in 
COPYA.OBJO, then writes a text file, EXEC's the written 
text file and loads in Super COPYA 1.1. (But best yet is 
the fact that DOS stays hooked with this method.) 

Super COPYA has been put through the pace's 
recently and works great. I am sure if you are a COPYA 
user you will find this the best addition to your copy 
programs since Copy n Plus. 

IT]Boot your DOS 3.3. master disk and enter BASIC. 

I 2 I Insert a blank disk in the drive and initialize it. 

INIT HELLO 

I 3 I Take out your favorite file copy program (Copy n 
Plus or equivalent) and copy "COPYA" and 
"COPY.OBJO" from the DOS 3.3 master to the freshly 
initialized disk. 

I 4 [ Boot the new disk and get into BASIC. 

NEW 

RENAME COPYA,C 

LOAOC 

70 

[TlType the Super COPYA 1.1 listing 
I 6 I Save the changed program as C. 
SAVEC 

I 7 I Clear memory and type the Hello program. 

NEW 

—enter the hello program here— 
SAVE HELLO 

Now you are finished and have a great addition to your 
copy programs. 

Super CopyA vl.l 



SUPER COPYA 
VERSION 1.1 
BY SCOTT M. SIMON 
DECEMBER 19, 1988 



10 REM 

20 REM 

30 REM 

40 REM 

50 REM 

60 REM 

80 GOT0490 

85 HOME : PRINT : PRINT : PRINT 

89 HOME ; PRINT : PRINT : PRINT : PRINT : PRINT 

180 INPUT "-'PRESS*' RETURN "KEY'TO'BEG I N'COPY'-" ; 1$ 

185 HOME : VTAB 2: HTAB 5: PRINT "SUPER'COPYA'l . 1" 

195VTAB7: HTAB 24: INVERSE : PRINT "READING" : NORMAL 

225 VTAB 7: HTAB 24; print "'"""" : IF PEEK (713) = 1 

THEN 290: REM 7 SPACES 
246 VTAB 10: HTAB 24: INVERSE : PRINT "INITIALIZING" : 

NORMAL 
251VTAB10: HTAB24: print """""""" : REM12SPACES 
256 VTAB 10: HTAB 24: INVERSE : PRINT "WRITING" ; : NORMAL 

: PRINT""'" : REM 3 SPACES 
265 VTAB 10: HTAB 24: PRINT """'"" : REM 7 SPACES 
305 TEXT: HOME : CALL 672: END 
490 HOME 



495 POKE 47426,24 

500 VTAB 1 : PRINT "SUPER'COPYA'l . 1" 

501 VTAB 2: PRINT "MODI FIED'BY'SCOH'H. 'SIMON" 

502 VTAB 3: PRINT "DECEMBER' 19, '1988" 

505 VTAB 6: INVERSE : PRINT "CHANGES'FOR'R»i(TS" : NORMAL 
508 VTAB 7: PRINT "DOS'ERROR'CHECKING' IS'SET'TO'OFF" 
509 VTAB 8: PRINT "MAKE'NO'MORE'THAN'3'CHANGES'TO'RffTS" 
510 VTAB 9: PRINT "PRESS' LETTER'TO'CHANGE'DOS'RffTS" 
515 VTAB 1 1 : PR I NT "A .' I GNORE'ADD'HEADER'&'CHECKSUMS" 
520 VTAB 12: PRINT "B.' ALLOW D4/D5' IN' ADDRESS' 

PROLOGUE" 
530 VTAB 13 : PR I NT "C .' I GNORE'ADD'&'DATA'EP I LOG'ERRORS" 
535 VTAB 14: PRINT "D.' IGNORE' 1ST' EPILOGUE' BYTE" 
"E . 'CONT I NUE'READ I NG'ON'ERRORS" 
"F . ' I GNORE' IST'BYTE'OF' PROLOGUE" 
"G . ' IGNORE'DATA'CHECKSUM'BYTES" 
' I .'DOS'CHANGES'SELECTED' -'START' 



540 VTAB 15: PRINT 
545 VTAB 16: PRINT 
550 VTAB 17: PRINT 
570 VTAB 19: PRINT 

COPYING" 
600 VTAB 22 : PR I NT "SELECT'LEHER'&'H I T'RETURN" 



INPUT 



;Z$ 



605 IFZ$ = 
610 IFZ$ = 
615 IFZ$ = 
625 IFZ$ = 
630 IFZ$ = 



" THEN 600 

A" THEN 700 

B" THEN 710 

C" THEN 720 

D" THEN 730 
635 IFZ$ = "E"THEN740 
640 IFZ$ = "F"THEN750 
642 IFZ$ = "G"THEN760 
655 IFZ$ = "I"THEN85 

700 POKE 47444 , 41 : POKE 47445 , : POKE 47498 , : GOTO 600 
7 10 POKE 47444, 74: POKE 47445, 201: POKE 47446, 106: POKE 

47447,208: POKE 47448,239: GOTO 600 
720 POKE 47497 , 24 : POKE 47498 , 96 : POKE 47397 , 24 : POKE 

47398,96: GOTO 600 
730 POKE 47506 , 234 : POKE 47507 , 234 : GOTO 600 
740 POKE 929, 24: GOTO 600 
750 POKE 47447, 00: GOTO 600 
760 POKE 47397 , 24 : POKE 47398 , 96 : GOTO 600 
800 END 

Checksums 



10 - $BADD 

20 - $9B13 

30 - $4D3B 

40 - $AD92 

50 - $C899 

60 - $FF65 

80 - $3D1C 

85 - $877B 

89 - $327D 

180 - $7EA0 

185 - $619E 

195 - $FA2E 

225 - $EF36 

246 - $A2CC 

251 - $7C67 

256 - $8D02 

265 - $B155 

305 - $31F7 



490 - $9EF0 
495 - $DBBC 

500 - $209C 

501 - $524A 

502 - $89F6 
505 - $EE0B 

508 - $867A 

509 - $098B 

510 - $D194 
515 - $673F 
520 - $6C86 
530 - $7095 
535 - $C54A 
540 - $DDB5 
545 - $AF26 
550 - $5C98 
570 - $1FEC 
600 - $D5AC 



605 - $EAE4 
610 - $7887 
615 - $C371 
625 - $A8A7 
630 - $20A5 
635 - $1C19 
640 - $A682 
642 - $021B 
655 - $1D39 
700 - $9984 
710 - $86FF 
720 - $C902 
730 - $389B 
740 - $34A5 
750 - $EE08 
760 - $E4D3 
800 - $B8C1 



Super Copy 1.1 Hello 



0TEXT 

70 PRINT "BLOAD'COPY.OBJ0" : REM A$2C0 

83 VTAB 9 : HTAB 2 : PR I NT "SUPER'COPYA' 1.1" 

85 VTAB 12 : HTAB 2 : PR I NT " IS'LOAD I NG ! " 

100 D$ = CHR$ (4) 

110 PRINT D$; "OPEN'CMDS" 

120 PRINT D$; "WRITE'CMDS" 

140 PRINT "RUN'C" 

160 PRINT D$; "CLOSE'CMDS" 

170 PRINT CHR$ (4); "EXEC'CMDS" 



Checksums 



- $A951 100 - $BA6C 160 - $C92C 

70 - $53B7 110 - $AE27 170 - $4447 

83 - $D459 120 - $AF8F 

85 - $F972 140 - $D8EE 
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Tim Rafert 



An even BETTER bootable Thexder 



After teading Mountain Man's article on "A Better 
Bootable Thexder" (COMPUTIST #62, pp.9-10), I 
thought I'd try to get it to work with GS/OS in the same 
way. It is actually very similar to his bootable Thexder 
with just a few changes. So, here is yet another way to 
make a self-booting Thexder! 

■ Reqairements 

D GS/OS system disk 

D Deprotected copy of Thexder by Sierra On Line 

n Copy n Plus (or something similar) 

D Blank ZW disk 

This backup holds all 16 levels and uses the new and 
somewhat faster GS/OS. 

I 1 I Make a copy of the deprotected Thexder. 

[T1 Copy the file PRODOS from the GS/OS system disk 
to the new Thexder disk. 

I 3 I Create a subdirectory named SYSTEM on the new 
Thexder disk. 

[XjCopy the following three (3) files from the GS/OS 
disk out of the SYSTEM subdirectory and into the new 
SYSTEM subdirectory on the new Thexder disk: 
START.GS.OS, GS.OS, ERROR.MSG 

I 5 I Create a new subdirectory named TOOLS in the 
SYSTEM subdirectory. 

re"! Copy the file TOOL025 from SYSTEM/TOOLS on 
the GS/OS disk into the new TOOLS subdirectory on the 
new Thexder disk. 

m Copy the whole subdirectory called SYSTEM.SETUP 
on the GS/OS disk to the new Thexder disk under the 
SYSTEM subdirectory. (Or create SYSTEM.SETUP as 
a new subdirectory on the new Thexder disk in the 
SYSTEM subdirectory and then copy the two files, 
TOOL.SETUP and TS2, from the GS/OS disk into this 
new subdirectory.) 

[T]Copy the whole subdirectory called FSTS on die 
GS/OS disk to the new Thexder disk under the SYSTEM 
subdirectory. (Or create FSTS as a new subdirectory on 
the new Thexder disk in the SYSTEM subdirectory and 
then copy the two files, PRO.FST and CHAR.FST, from 
the GS/OS disk into this new subdirectory.) 

[T] Rename the file called THEXDER on your new 
Thexder disk to THEXDER.SYS16. 



I 10| If your new disk is not already named THEXDER, 
change it to THEXDER. 

I 111 If you want to, you can delete the two files, 
FINDER.ROOT and FINDER.DATA, from this new 
bootable Thexder disk. 

The new Thexder disk's directory should be arranged 
as follows: 

/THEXDER/ f/ie vohim name 

DATA/ DIR of original stuff {all of it's original data files) 
THEXDER . SYS 16 original stuff-just changed the name 
PRODOS frm GS/OS disk 
SYSTEM/ subdirectory you created 
START.GS.OS 
GS.OS 

ERROR MSQ. all 3 from GS/OS disic 
TOOLS/ subdirectory you created 

TOOL025 only tool we need from GS/OS disk 
SYSTEM . SETUP/ whole thing from GS/OS disk 
TOOL.SETUP 
JSl both from GS/OS disk 
FSTS/ whole thing from GS/OS disk 
PRO.FST 
CHkRJSl both from GS/OS disk 



Softkey for.. 



Into the Eagle's Nest 

Mindscape Software 



■ Requirements 

D Fast Copier (Locksmith Fast Copy, Disk Muncher, 

etc.) 
D Sector Editor (Copy II Plus v7-up) 
D Blank Disk 

Into the Eagle's Nest is an interesting game with a 
similar objective as in Beyond Casde Wolfenstein, with 
a few new twists added. As in BCW, you must (in 
advanced levels) plant charges and blow up the castle, but 
you must also rescue your captured buddies, save precious 
art treasures, and kill coundess Nazi soldiers and drunken 
officers. The graphics and sounds are quite good, with 
midticolored double hi-res shapes and a realistic explosion 
sound if you foolishly shoot at open crates of TNT (in this 
one, you can hear yourself getting completely fried.) For 
the benefit of newcomers to the softkeying process, I will 
provide a lengthy explanation as to how I discovered and 
defeated this fairly simple protection scheme. 

The Protection 

The protection on this recent Mindscape release 
consists of a small nibble count routine. I discovered this 
litde devil by listening carefully when I booted up a copy 
made by Disk Muncher. After I booted, about 3 seconds 
passed when I heard the disk head recalibrate, followed 
by the drive stopping dead in its tracks. This told me that 
there was indeed a nibble count and that the program 
somewhere executed the instruction LDA $C088,X to turn 
off the disk drive and leave my Apple hanging. Mostiy 
by trial and error, I made several copies of the original 
and scanned them for the string 8D88C0, using the scan Hex 
feature of Copy II Plus. I then changed each occurence 
of that string to EA EA 60, one at a time, until the change on 
ttack $(X), sector $08, finally did it the second attempt. 
Mind you, I didn't eliminate the entire nibble count; I just 
bypassed it by replacing the 'turn off disk drive' command 
string with 'do two NOP's and Return to wherever you 
came from. ' This successftdly returned control to the main 
program, and now it works like a charm. 

Cookbook Style 

I 1 I Make a copy of the original disk usmg a fast copier 
which will ignore errors. 

I 2 [ Change the following bytes using the sector editor: 

Irk Set Byte(s) From To 



$00 $08 $63-65 BD88C0 



EA EA 60 



Enjoy. 
Playing Up for.. 



Maniac Mansion 

Lucasfilm 



• To use the radio, find the tube and place it in the socket. 
Can't find the tube? Well, in what antiquated (but still 
useful) items are they used? 

• There is a significant key to the game hidden behind 
the hamster. 

• If you give Weird Ed his package, you'll be his friend 
(as long as you do what he asks of you). 

• To thoroughly investigate Nurse Edna's room, do the 
following: Station one kid at the phone, another right 
outside of Edna's room. Dial the number found on the 3rd 
floor behind the mummy (you did find the faucet handle, 
right?), and then enter her room. Be quick to look around, 
however, because you have only several minutes before 
Edna hangs up and gets smart to your plans. 

• To get the rusty key: Find the record up in the green 
tentacle's room, get it, then go downstairs until you get 
to the room with the T.V. If you don't have the blank 
cassette tape then, get it now. Insert the cassette into the 
cassette recorder, push record, place the record on the 
Victrola, play it. You should hear a momentary high- 
pitched sound. Turn off the recorder, pick up the cassette. 
Go down to the room preceding the den, and after you 
place the tape into the player, mm on the player, watch 
what happens, and pick up the key to freedom. 

• The gleaming key can open two special locks. 

• What would you use to suck up a puddle? 

• If you are in a destructive mood. Use the yellow key 
in the Edsel! 



• Whatever you do, don't touch that red button in the 
deeps!! 

• O.K. You've gone down into the depths after turning 
on the valve. You found what was there and you 
immediately go to turn off the valve. WATT A MINUTE! ! 
Don't turn that valve off yet! You'll drown your kid! 

To Marc Batchelor: Concerning your Autoduel Car 
Editor, for some reason, it doesn't work on my copy. I 
typed the whole thing in myself, paying close attention 
to my typing (the checksums matched perfectiy). When 
I RAN it, I edited a car, but when I returned to playing 
the game, I discovered that I could not leave New York 
by any means. Right before the road comes up on the 
screen, I hear a strange 'click,' followed by the program 
hanging. Help with this wUl be appreciated. 

To Jan Recourt: I, too, wish I could put the Ultimas 
on a 3Vi" disk. But it seems quite complex. Somehow, 
you woidd need to make major modifications on the 
program so that it would access only the slot which has 
the 3 V^ " drive. In addition, one would have to go through 
the program and find some space to put in a PREFIX 
command, since you'll probably be using ProDOS, and 
since some of the filenames on the separate disks are 
identical (either that or go through and change all of the 
filenames in the catalog, and then change the program so 
it will load those files). Geez, I wish more companies 
would just put their programs in separate FILES. That 
would make it MUCH simpler to transfer to a hard- or 
micro-disk. 



Gary Rohr 



Softkey for.. 



Broadsides v2.0 

Strategic Simulations Inc. 



■ Requirements 

D Original Broadsides v2.0 diskette 
n An intialized diskette with the hello program 
deleted that contains SUPER lOB, swap 
confroUer, standard controller, and DISKEDIT 
D One blank diskette 

About a year ago I attempted to de-protect this game, 
without success. After reading Craig Meekin's softkey in 
the November 1988 issue of Computist, I tried again ~ 
it didn't work. 

I used the nibble editor on Copy II Plus to check the 
prologues and epilogues of my disk versus that of Craig's 
and found they weren't even close to the same - so I 
decided to see if I could crack mine this time around. 

Armed with a Wildcard, so I could break into the 
monitor at will, I started by capturing the RWTS. Using 
SUPER lOB, it was a simple matter to convert the 
protected diskette into one which was readable. I then 
searched the diskette for the standard BD 8C C0 sequence, 
indicating that a byte was being read from the diskette and 
altered the checks for prologues and epilogues to the 
standard format. 

I tried booting the diskette, but it still wouldn't work. 
I decided to perform some boot code tracing to find out 
where it was hanging - it worked fine all the way up until 
it attempts to use the RWTS. I went back to examine the 
code being used and found it was slightly different from 
that which is normally used - 1 tried replacing it, but that 
didn't work either. After comparing the BROADSIDES 
RWTS with a normal one, and seeing it wasn't even close, 
I decided to try replacing the protected RWTS with a 
normal one. This time the boot went farther before it himg. 
I checked the RWTS parms to see what was being read 
and found a $20 error code (volume mismatch). I scanned 
the diskette for all locations which access $B7EB (the 
RWTS parm volume number) and found three locations 
where it is set to $FF. I tried using SUPER lOB to copy 
the diskette to a new one initialized with volume #255 - 
the boot didn't even get as far as it did before. I checked 
the RWTS parms error code, and found it was looking 
for volume #254. 1 decided to go back to the other diskette 
and change the $FF bytes to $FE bytes. I fried booting 
the de-protected version once again - this time it worked! ! 

I 1 [ Boot the Broadsides v2.0 diskette and interrupt as 
soon as the DOS prompt appears. 



COMPUTIST (fW 



# Readers Data Exchange < 



23 



I 2 [ Enter the monitor. 
CALL -151 

[T]Move the RWTS to a safe location. 
1900<B800.BFFFM 

I 4 I Boot the SUPER lOB diskette with the hello program 
deleted. 

C600G 

[TJSave the RWTS to disk. 

BSAVE RWTS.BROADSIDES, A$1900, L$800 

I 6 I Load Super lOB and merge the swap controller. 

LOAD SUPER lOB 
EXEC SWAP.CON 

I 7 [ Change the following lines. 

1010 TK = 1:ST = 0:LT = 35:CD = WR 
10010 IF PEEK(6400)<>56 THEN PRINT CHR$(4)"BL0AD 
RWTS.BROADSIDES,A$1900" 

I 8 I Run the program. Answer yes to the format question 
and use a volume number of 254. 

RUN 

I 9 I When done, change the following lines and run again. 

1010TK=0:ST=1:LT = 1:CD=WR 

1060 GOSUB 490:TK=T1:ST = 1:GOSUB 360 

RUN 

I 10| Then, reload Super JOB and merge the standard 
controller. Modify the controller to copy the RWTS (trk 
$00, set $02-09). Use the the SUPER lOB disk as the 
source disk. 

LOAD SUPER lOB 

EXEC STANDARD.CON 

1010 TK = 0:ST = 2:LT = 1:CD = WR 

1030 GOUB 430:GOSUB 100:ST = ST + 1: IF ST<10 THEN 

1030 
1060 GOSUB 490:TK = T1:ST=8 
RUN 

I 111 Clear Applesoft pointers and run Diskedit. 

FP 

RUN DISKEDIT 

\l2\ Read track $00, sector $00 from the original 
Broadsides disk, make the following sector edits, and write 
it out to the new "de-protected" disk. 

Trk Set Byte(s) From To 



$00 $00 $4A 


AA 


D5 


$53 


D5 


AA 


$5D 


AB 


96 


$88 


AA 


D5 


$91 


D5 


AA 


$9B 


EB 


AD 



I 13| Perform the following sector edits on the new "de- 
protected" diskette. 

Trk Set Byte(S) From To 



$00 $03 $1A 


AA 


D5 


$23 


D5 


AA 


$2D 


AB 


96 


$57 


AA 


D5 


$60 


D5 


AA 


$6A 


EB 


AD 


$00 $06 $CB 


FF 


FE 


$00 $07 $D0-D1 


49 FF 


A9FE 


$EB 


FF 


FE 


$02 $03 $68-6A 


49 FF FF 


A9 FE FE 



Enjoy! 



Douglas Bancroft 



Playing Tip for... 



Marble Madness 

Electronic Arts 



way to finish Level 3. Normally, you would probably go 
down the track, taking a right and then a sharp left. Instead, 
near the end, take the narrow path that leads onto a belt 
of some sort. Ride the belt down toward the edge of the 
screen and hop off of the belt onto another path. From 
that path take a right and go to the striped finish area. Note: 
I have only done this with a joystick. Warning: If you try 
to get onto the belt and you hit a pile, you will be flung 
off. Also, if you stay on the belt too long, you will lose 
your marble. 



Matthew D. Bancroft 



A.P.T.for... 



Marble Madness 

Electronic Arts 



Micheal A. Horton's article in Computist #50 on page 
7 was very helpful but unfortunatly it had some problems 
they were: 

• If you die, the marble will keep restarting where you 
died 

• He showed you where the entrance to the water-maze 
was, but didn't tell you how to get over to the maze 
entrance. 

• If you were to put in the Unlimited Time APT, you 
couldn't get into die 'Secret Maze'. 

I have discovered ways to 'Fix' these problems: 

• For the 'you're history' problem, search for A9 00 9D 
77 60 A9 07, and change it to 60 EA 9D 77 60 A9 07. 

• For the problem of not being able to get to the entrance 
to the water-maze; simply get into the first level, go down 
to the first curve from the bottom and "Super-charge" 
your marble. Go back up to the peak of the second curve 
from the bottom and get off of it onto the side with the 
entrance to the water-maze. 

• For the unlimited time patch, search for BD 77 60 F0 08 
A9 02 and change it to BD 77 60 D0 08 A9 02 . This will allow 
you to manuever in all mazes except ice. In that situation, 
when the counter hits zero, you are stuck forever. Can 
someone improve this fix? 

A hint: It seems that you do not want to run across 
the thing that looks like a bridge in the first water maze 
level. You don't even want to hit it. It is a dam and if 
you hit it it will break. The current of the river will be 
going so fast that you will be washed down stream and die. 



Bob Igo 



APT Scanner 



This program can be most effectively used in 
conjunction with the DeathSword article I sent outlining 
APT-finding Techniques (COMPUTIST #65). 

Type in the BASIC program, save it (SAVE APT 
SCANNER) and then enter the assembly language program 
at $6000 and save it (BSAVE SCANNER, A$6000, L$4E). 

I'll see you at the bottom. 



APT SCANNER 



While playing Marble Madness, I discovered an easier 



80 REM -APT SCANNER-- 

85 TEXT 

95 IF PEEK (24576) < > 169 THEN PRINT CHR$ (4) "BLOAD' 

SCANNER" 
100 I F PEEK (768) <> 169 THEN PR I NT CHR$ (4) "BLOADDOS* 

UTILITY" 
110 HOME ;TR = 784:SE = 789:RW = 794:R = 1:W = 2: POKE 

799,0: POKE 804,32:A = 8I92:P = 768: POKE 774,96: 

POKE 779,1 
112DIMT$(34),S$(15) 
115FORT = 0TO34: READT$(T) : NEXT : FORS = 0TO15: READ 

S$(S):NEXT 
120 INPUT "STARTINGnRACK" (0-34):'" ;ST 
130 INPUT "ENDnRACK'(0-34) :'" ;ET 
132 PR I NT "SLOT'FOR'OUTPUT : '" ; : GET SL$ : SL = VAL (SL$) : 

PRINT SL 
135 HOME : PRINT "rWILL'SCAN'FOR*LDA,'LDX,'AND'LDY." 

: PRINT "WHArVALUE'SHOULDN'SEARCH'FOR'AFER" : 

PRINT "EACH' OF* THESE?" : PRINT : INPUT "VALUE' 

(0-255):'" ;VA 

136 POKE 24912, VA: HOME : POKE 34,1 

137 POKE RW.R: PR#SL 



138VTAB3: PRINT "TRACK" , "SECTOR" , "BYTE" 

139VT = 4 

140 FOR T = ST TO ET 

150FORS = 0TO15 

160 POKE TR,T: POKESE.S 

161 PR# 

165 VTAB 1: HTAB 1: PRINT "TRACK'$" T$(T) , "SECTOR'$" 
S$(S) 

166 VTAB VT 
170 CALL P 
175 PR# SL 
180 CALL 24576 
185 PR# 

195 VT = PEEK (37) + 1 

200 NEXT S 

210 NEXT T 

300 DATA 00,01,02,03,04,05,06,07,08,09,0A,0B,0C,0 

D,0E,0F,10,11,12,13,14,15,16,17,18,19,1A,1B,1C 

, ID, IE, IF, 20, 21, 22 
310 DATA 00,01,02,03,04,05,06,07,08,09,0A,0B,0C,0 

D,0E,0F 



Checksums 


80 


- $0244 135 - $390A 


166- 


- $28D0 


85 


- $18D6 136 - $1C8A 


170- 


-$D7DC 


95 


- $CE87 137 - $4096 


175- 


- $924C 


100 


- $BD54 138 - $6EF5 


180- 


- $B8A1 


110 


- $0BCC 139 - $2842 


185 ■ 


- $5592 


112 


- $9664 140 - $E63D 


195- 


- $CBD4 


115 


- $681B 150 - $BFF9 


200- 


- $5557 


120 


- $2A30 160 - $2D2C 


210- 


- $A543 


130 


- $DE81 161 - $50E3 


300 


- $9450 


132 


- $2DEF 165 - $06DD 


310 


- $4D2A 




SCANNER 


6000: 


A9 A9 8D 00 61 A9 A2 8D 




$8439 


6008: 


01 61 A9 A0 8D 02 61 A0 




$6F86 


6010: 


00 A2 00 B9 00 20 DD 00 




$A68E 


6018: 


61 F0 09 E8 E0 03 D0 F3 




$7E10 


6020: 


08 D0 BE 60 89 01 20 CD 




$E1A7 


6028: 


50 61 D0 EF A9 00 85 24 




$1884 


6030: 


AD 10 03 20 DA FD A9 10 




$E487 


6038: 


85 24 AD 15 03 20 DA FD 




$2ADE 


6040: 


A9 20 85 24 98 20 DA FD 




$2200 


6048: 


20 8E FD 40 IB 60 




$F92F 




SCANNER disassembly 


A9A9 


LDA #$A9 






8D 00 61 STA $6100 






A9A2 


LDA #$A2 






8D 01 61 STA $6101 






A9A0 


LDA #$A0 






8D 02 61 STA $6102 






A0 00 


LDY #$00 






A2 00 


LDX #$00 






B9 00 20 LDA $2000, Y 






DO 00 61 CMP $6100, X 






F0 09 


BEQ $6024 






E8 


INX 






E0 03 


CPX #$03 






D0F3 


BNE $6013 






C8 


INY 






D0EE 


BNE $6011 






60 


RTS 






B9 0120 LDA $2001, Y 






CD 50 61 CMP $6150 






D0EF 


BNE $601B 






A0 00 


LDA #$00 






85 24 


STA $24 






AD 10 03 LDA $0310 






20 DA FD JSR $FDDA 






A910 


LDA #$10 






85 24 


STA $24 






AD 15 03 LDA $0315 






20 DA FD JSR $FDDA 






A9 20 


LDA #$20 






85 24 


STA $24 






98 


TYA 






20 DA FD JSR $FDDA 






20 8E FD JSR $FD8E 






4C IB 60 JMP $601B 







24 



# Baaitow Data gKchange # 



COMPUTIST m» 



Okay. Now that we've gotten the tedium out of the 
way (unless you really really love to type), here are some 
instructions: 

Run the BASIC program (RUN APT SCANNER), 
then insert the disk to be scanned in drive 1 . Enter as 
the starting track and 34 as the end track. To make things 
easier, I decided to use my printer as output, slot 1 in my 
case. You next enter the number of lives the game gives 
you. The next bit is easy.... we wait. 

On Saracen, the technique I outlined in my 
DeathSword article must be modified to work. Instead of 
DECrementing the location directly, the program loads 
the ciurent number of lives into the Accumulator and then 
uses the SBC #$01 command to subtract one from the 
Accumulator. The new number is then stored back into 
memory where the old one was. I don't know why they 
do it this way, maybe just to aimoy me. 

Buck Rogers was pretty straightforward. You scan for 
the number of lives with APT SCANNER and then use 
the technique I outlined in my DeathSword article. 
Actually, instead of doing that exactly like I described, 
the expert (or advanced beginner) can look at the 
disassembly of the locations which the scanner found to 
see where the theoretical number of lives is stored in all 
cases. Then, after writing them down, play the game and 
get "killed" once. The nimiber of lives should now be 
one less than what was originally searched for. Reset into 
the monitor (or somehow break the program's execution) 
and check all the locations where you thought the number 
of lives could have been stored. If you find one which holds 
the current number of lives, then you now know which 
edit to make. Then, run Editor Creator and make a quick 
editor program. Next, send it in to Computist! 



Item # 



Item 



A.P.T.for... 






Saracen 

Datasoft 


For unlimited lives. 

Trk Set Byte(s) From 


To 


$20 $0B $A4-A5 
$20 $08 {DD-DE 


E9 01 
E9 01 


EAEA 
EA EA 


A.P.T. for... 


Buck Rogers 

? 



For unlimited ships. 

Trk Set Byte(s) From 



To 



$02 $0A $98-99 C6AE 


EAEA 


$02 $08 $03-04 C6AE 


EAEA 


$0A$0A$3F-40 C6AE 


EAEA 


$0A$0C$A8-A9 C6AE 


EAEA 



Addendum to the A.P.T. for.. 



Kid Niki Radical Ninja 

Data East 



The Kid Niki edits in Computist #60 were not where 
they were stated to be on my copy. On mine, they appeared 
on track $07, sector $0F. Other than that, they are the 
same bytes in the same positions on the track. 



Phil Goetz 



A.P.T.for... 



Montezuma 's Revenge 

Parker Brothers 



■ Requirements 

D Cracked Disk with program on DOS 3.3 as normal 
Bfile 

Presuming you already have Montezuma's Revenge 
as a DOS file, here's some good cheats: 
Location Contents 



EO 
El 
E2-E6 



# of men 

# of items (up to 5) 
Items 



2B Gold (useless?) 

2F Snakeproofing 

33 Sword 

37 Torch 

3B Key A 

3F Key B 

43 White key 

47 Chest (useless?) 

Keys A and B are different colors, but I know not 
which because I have a B«&W monitor. 

To give yourself an item, change the reset vector to 
point to the monitor (see program below), and press reset 
in the game. Change the values, then type 



Mike Maginnis 



C050 
C057 
6026G 



graplucs 
hi-res 



resume game 

The game will act strangely until you move into a new 
room. 

Here's a program which will let you redirect the reset 
vector, have an infinite number of men, be fireproof, 
fallproof, and/or monsterproof , and/or not need keys for 
doors: 



Montezuma's Revenge - Reset fix and APT 



2 PRINT CHR$ (4) "BLOADMONTEZUMA'S'REVENGE" 

5FORN = 1TO6:READV$(N,0),V$(N,1),D$(N),L(N),N(N): 
NEXT 

i0TEXT : HOME :A$ = "MONTEZUMA "S^REVENGE" : GOSUB900: 

PRINT : PRINT 
30FORN = 1TO6:D(N)=PEEK(L(N))=N(N): PRINT: PRINT 

N".'" ;: IFD(N) THEN INVERSE 
40PRINTV$(N,0); : NORMAL : PRINT"/" ; : IFNOTD(N)THEN 

INVERSE 
50 PRINT V$(N, 1) ; : NORMAL : PRINT "'" D$(N) : NEXT 
60 PRINT : PRINT"7.*RUN*M0NTEZUMA'S*REVENGE" : PRINT 

: PRINT "8.*EXirT0*BASIC" : PRINT : PRINT 
80 PRINT : PRINT "ENTER^YOUR'CHOICE:*" ; : GETA$: PRINT 

A$ 
85N = VAL(A$): I F NOT N THEN 10 
90 ON N GOTO 100 , 200 , 300 , 400 , 500 , 600 , 700 , 800 : GOTO 10 
100 IF D(l) THEN POKE 5105,89: POKE 5110,255: GOTO 10 
110 POKE 5105,4: POKE 5110,96: GOTO 10 
200 IF D(2) THEN POKE 27917, 169: POKE 27918,0: GOTO 10 
210 POKE 27917, 198: POKE 27918,224: GOTO 10 
300 I FD(3) THEN POKE 27419, 24: POKE 27420 , 96 : GOTO 10 
310 POKE 27419, 169: POKE 27420,15: GOTO 10 
400 IF D(4) THEN POKE 27653,0: POKE 27654,76: POKE 

27655,47: POKE 27656,105: GOTO 10 
410 POKE 27653,26: POKE 27654, 141: POKE 27655,40: POKE 

27656,21: GOTO 10 
500 I F D(5) THEN POKE 26779 , 24 : POKE 26780 , 96 : GOTO 10 
510 POKE 26779,201: POKE 26780,7: GOTO 10 
600 IF D(6) THEN POKE 31938,27: GOTO 10 
610 POKE 31938, 176: GOTO 10 
700 CALL 5104 
800 END 

900 PRINTTAB( 21 - INT ( LEN (A$) / 2 + .5))A$: RETURN 
1000 DATA "RESTART" , "MONITOR" , "RESET" ,5105,4, 

"FINITE" , "INFINTE" , "MEN" ,27917,198, "NORMAL" 

, "FIREPROOF" , "MEN" ,27419,169, "DIE" , "LIVE" , 

"AFTER" A'FALL" ,27653,26 
1100 DATA "FEAR" , "DONTFEAR" , "MONSTERS'&'CHAINS" 

,26779,201, "NEED" , "DON'T* NEED" , "KEYS" 

,31938,176 



Checksums 



2 - $E388 
5 - $D06C 
10 - $AC72 
30 - $F8EA 
40 - $F445 
50 - $786D 
60 - $1D42 
80 - $3C54 
85 - $62F0 



90 - $0254 
100 - $A557 
110 - $09CB 
200 - $0124 
210 - $AFDE 
300 - $22A9 
310 - $F2E6 
400 - $B9E8 
410 - $F4D0 



500 - $8BAA 
510 - $5E11 
600 - $E37E 
610 - $2F8F 
700 - $7146 
800 - $D12A 
900 - $A3B8 
1000 - $3B4F 
1100 - $4910 



Softkey for., 



Times of Lore 

Origin Systems 



Rule #1 of the Software Deprotector's Guide: a 
company will usually use the same protection on several 
different programs. Times of Lore, the newest release 
from Origin Systems has exactly tiie same protection as 
Ultima V, another of Origin's epic adventures. Times of 
Lore is the arcade answer to Ultima V: the game can be 
played entirely by joystick. I consider Times of Lore the 
link between Gauntlet and the Ultima series. To copy 
Times of Lore (side 1; side 2 is not protected): 

I 1 I Type in the machine language program an save it on 
your Super lOB disk. 

CAU. -151 

1900: A2 00 BD B8 BF 18 69 11 $E96C 

1908: 9D B8 BF E8 EO 10 DO F2 $7UF 

1910: 60 A2 00 BD B8 BF 38 E9 $353D 

1918: 11 9D B8 BF E8 EO 10 DO $B7FB 

1920: F2 60 $e0D7 
BSAVE TIM^.SC, A$1900, L$022 

(or use ULTIMA 5.SC - used to copy Ultima V in 
COMPUTIST #61, it's the same thing) 

VT] Merge the controller into Super lOB and copy side 
one of the game disk. 

[TJCopy the back side with COPYA or Super lOB's 
standard controller. 



Controller 



1000 REM T I MES OF LORE CONTROLLER 

1010TK = 0:ST = 0:LT = 35:CD = WR 

1020 POKE 47507,0: POKE 47517,0 

1030 UB = 0:T1=TK:GOSUB 490 

1040 IF U8 = l THEN 1060 

1050 I F TK = > 3 THEN CALL 6400 : UB = 1 

1060 GOSUB 430 : GOSUB 100 : ST = ST + 1 ; I F ST < DOS THEN 

1060 
1070 I FBF THEN 1090 

1080 ST = 0:TK = TK + 1 : I F TK < LT THEN 1040 
1090 U8 = 0: GOSUB 490:TK = Tl :ST = 
1100 IF UB = 1 THEN 1120 
1110 CALL 6417 :UB = 1 
1 120 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS THEN 

1120 
1130 ST = 0:TK = TK + 1 : IF BF = AND TK < LT THEN 1100 
1140 IFTK<LTTHEN1030 
11 50 POKE 47507, 174: POKE 47517, 164: HOME : PRINT "COPY" 

DONE." : END 
10010PRiNTCHR$ (4); "BLOAD'TIMES.SC,A$1900" 



Checksums 



1000 - $3568 
1010 - $3266 
1020 - $5917 
1030 - $51D2 
1040 - $8CF8 
1050 - $DE3C 



1060 - $D138 
1070 - $0586 
1080 - $752E 
1090 - $D00D 
1100 - $68D6 
1110 - $6483 



1120 - $4681 
1130 - $2068 
1140 - $D390 
1150 - $16C5 
10010 - $9F86 



The credit on this one really goes to Captain Dan for 
his softkey - all I did was use it on another program. 



Jim S. Hart 



Softkey for... 



Microzine ^25 

Schoolastic 



COMPUTIST in% 



■ Requirements 

D Microzine #25 original disk 

D Whole disk copy program 

D Blank 5 »4" disk 

D Initialized DOS 3.3 disk with no files on it 

Sometimes I forget to leave myself notes on how a 
deprotection was arrived at, so this softkey is short and 
simple. 



< ReadaTB Date Exchange # 



25 



I 1 l Use your whole disk copier to copy the original 
Microzine tf25 onto the blank SW" disk. 

rri Boot the DOS 3.3 disk with no ffles on it to get into 
BASIC. 

I 3 I Take out the DOS 3 . 3 disk and insert the copy of the 
Microzine #25 disk. 

I 4 I Get into the monitor and load the file with the 
protection code. 

CALL -151 
BLOAD T0C.6 

I 5 I The file starts at $9000 and requires the accumulator 
to be zero, and the carry to be clear, for the protection 
call to be successfiil. Well, let's put the following three 
instructions at the start of the file, so that those two 
conditions will always be true: 

9000 A9 00 LDA #$00 load accumulator with a zero 

9002 18 CLC clear the carry flag 

9003 60 RTS return to the calling routine 

I 6 I Now, save die file back to the copy of the Microzine 
#25 disk: 

BSAVE T0C.6, A$9000, L$95 

You're all done! Check out the TOC.6 file to see some 
protection code if you are new to the deprotection game. 

if Softkey for... 



Paint With Words & Word Art Show 

MECC 



■ Requirements 

n MECC Paint With Words & Word Art Show 

original disk 
D A freshly initialized 5U" disk 
D RWTS WORM program from COMPUTIST #61 
D Super lOB vl.5 
D NEW SWAP conti^oller for Super lOB vl.5 

The only protection here are simple format changes. 
Nothing hard at all, especially if you have my RWTS 
WORM program from COMPUTIST #61. The RWTS 
WORM does all of the hard work and gets the MECC 
RWTS for you. All you have to do is to use the NEW 
SWAP conti-oUer with the saved RWTS. Here's how. 

IXjBoot a normal DOS 3.3 disk and load the RWTS 
WORM program into memory. 

BLOAD RWTS.WORM, A$9500 

[T] Insert die original MECC disk into slot 6, drive 1 and 
startup the RWTS WORM. 

CALL 38144 

I 3 [Insert your disk with Super lOB vl.5 and save the 
RWTS. Then, load Super lOB, merge the NEW SWAP 
controller and change these two lines before you run it. 

BSAVE RTWS.liaECC, A$1900, L$800 

LOAD SUPER lOB 

EXEC NEW SWAP.CON 

10010 PRINT CHR$(4); "BLOAD RWTS.MECC,A$1900" 

1015 TK = 3 

RUN 

. . .answer NO to ' 'Do you want to format the dupUcate?" 
prompt. 

You're done! 

Softkey for... 



Dive Bomber 

Epyx 



■ Requirements 

D Dive Bomber original 
D Blank 5U" disk 
D COPYA 
D Sector editor 

Dive Bomber is a somewhat interesting flight 
simulation game. Not the greatest gr^hics you'll find, but 
the game is pretty good nonetheless. The protection 
scheme used here is the good ol' stock Epyx protection 



of late. It is a variation of the protection on Boulderdash 
Construction Set, and in fact is the same variation that is 
used on the game Spiderbot (COMPUTIST #61). See my 
articles in COMPUTIST #57 and COMPUTIST #61 for 
a more in depth explanation of what's happening. 
Here are the steps to deprotect it. 

[TjBoot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and epilog errors and 
use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 

I 3 I Make the following sector edits to the copy you just 
made. 



Trk Set Byte(s) From 



To 



$00$09$10-2B A6 2BBD89C0BD A9E7 85F8A9FC 

8E C0 A9 80 85 FD 85 F9 85 FF A9 EE 

C6 FD F0 71 20 AF 85 FA 85 FD 85 FE 

5F B0 6C A5 F9 C9 A9 F3 85 FB A9 70 

0F D0 Fl A0 85 FC D0 50 



You're all done! 
Softkey for... 



Kid Nasi - Radical Ninja 

Data East 



■ Requirements 

D Kid Niki original disk 
n A blank disk 
D COPYA 
D Sector editor 

Again, the lack of keeping good notes causes me to 
be able to tell you what to do, but not why it was done. 
Oh weU. 

[T^Boot your DOS 3.3 system disk. 

I 2 [ Tell DOS to ignore checksum and epilog errors and 
use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 

I 3 I Make the following sector edits to the copy you just 
made. 



Trk Set Byte(s) From 



To 



$00 $0E $0F-$10 BD 89 



D0 6E 



Write that sector back to disk and you're all done! 
Softkey for... 



Introductory Algebra 
Intermediate Algebra 

Addison Wesley 



Softkey for., 



Fractions 

Percents, and Decimals,Aquarius People Materials 
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■ Requirements 

D Original disk 
D A blank disk 
D Super lOB vl.5 + NEW SWAP controller 

Nothing too hard about these disks. Just simple format 
alterations. 

I 1 [ Boot the original disk, and when you see the bracket 
prompt Q), press C once. The computer should beep and 
you should see the Applesoft prompt Q). 

I 2 I Reset the Applesoft auto run flag. 

FP 

I 3 I Get into the monitor and move the RWTS so we can 
use it. 

CALL -151 
1900<B800.BFFFM 

RHBoot your Super lOB disk and save the RWTS. 
< Reaitew Data EXchanga < 



BSAVE RWTS.PRG, A$1900, L$800 

ITl Merge your NEW SWAP controller with Super lOB 
vl.5 and then add this line before you run it. 

10010 PRINT CHR$(4)"BL0AD RWTS.PRG,A$1900" 
RUN 

Softkey for... 



Computer DrUl And Instruction: 
Mathematics 'Addition A ' disk 

Science Research Associates 



■ Requirements 

D ADDITION A original disk 
n A blank 5 W" disk 
n Whole disk copier 

The protection on this disk is a good meaty one to 
sink your teeth into. Computists who are past 'POKE 
47426,24, RUN COPYA' are advised to take a look here, 
because the protection scheme is a good one. Let's dig in! 

Preliminaries 

The disk can be copied by any whole disk copier, so 
there aren't any format changes to worry about. What kind 
of protection does that leave? If you said nibble 
count/signature check then you've been reading 
Computist! Yes, it is a nibble count/signature check, but 
the actual code itself is written in an extremely conftising 
way. So make a copy with COPYA (or equivalent) and 
put away the original - we won't need it any more. 

Boot DOS 3.3 and insert the copied disk. Enter the 
monitor and load the file with the protection code. 

CALL -151 
BLOAD lAPG CODE 

The call to the protection code is not at the 
beginning of the file, $55FD, but rather it is at 
$5C31. Let's take a look at this code. 

5C31L 

5C31-A9 00 LDA #$00 
5C33- 20 00 7B JSR $7B00 
5C36- 8D 6C 7A STA $7A6C 

The protection code itself lies at $7B00 and the 
disassembly you just looked at is where it is call^ 
from. I discovered that the protection is at $7B00 by 
tracing the code (not the best explanation for novices) 
as it was executed. This is something you can do after 
you have been at the deprotection business for a while 
- it just comes to you because of all the protection 
schemes you have been exposed to. Anyways, let's 
take a look at the start of the protection code: 

7B0OL 

7B00- 20 0F 5A JSR $5A0F 
7B03- 20 IF 7C JSR $7C1F 
7B06- A9 0F LDA #$0F 

Looking at the code at $5A0F and $7C1F, I 
found that these subroutines decode the actual 
protection code. We'll go ahead and execute them so 
we can see the actual protection code: 

5A0FG 
7C1FG 
7B00L 

Looks different, huh? Now comes the interesting 
part. To make the code as confusing as possible, the 
authors have made branches to other sections of code 
that are always taken. By putting these branches into 
the correct places in the code, the true meaning of the 
code will not be apparent from a listing. Let's look at 
an example: 

7B2AL 

7B2A- A9 00 LDA #$00 

7B2C- 48 PHA 

7B2C- 28 PLP 

7B2E- D0 01 BNE $7B31 

7B30- 4C 20 E3 JMP $E320 

7B33- 03 ??? 
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All looks ok until we hit the JMP $E320. Why would 
they jump to somewhere in the Apple's ROMs? Take a 
look at the instruction right before the JMP $E320. Notice 
that if the zero flag is not set, then we branch to the middle 
of the JMP instruction! Hmmm. . .maybe the zero flag will 
ALWAYS NOT be set so that the branch is ALWAYS 
taken. Let's see what the code looks like if we put a NOP 
in place of the byte that is ALWAYS branched over: 



7B30:EA 




7B2AL 




7B2A- A9 00 


LDA #$00 


7B2C- 48 


PHA 


7B2D- 28 


PLP 


7B2E- D0 01 


BNE $7B31 


7B30- EA 


NOP 



7B31- 20 E3 03 JSR $03E3 
7B34- 85 01 STA $01 

Now that looks a lot better! Notice that the JSR $03E3 
is now revealed, which is a DOS 3.3 page three vector 
that locates the input parameter list for the RWTS. What 
is important to notice is that it is a call to a page three 
location, which is where DOS 3.3 puts it's vectors, and 
that it is an instruction that you normally wouldn't see, 
unless you made the change we did. If you were wondering 
if there are any more of these 'hidden' instructions, then 
let me assure you, there are lots more of them. I'm not 
going to list every hidden instruction for you; I leave that 
up to the individual who wants to sharpen their 6502 
assembly and softkeying skills. 

After I went through and found all of the hidden 
instructions and NOPed out aU useless bytes, I found that 
on a successful protection check, the A-register contains 
a zero. All of the time the protection scheme's author must 
have spent writing confusing code, makes it seem foolish 
that the only results it needs is a zero in the A-register. 
What a waste of time. WeU, it was a good mental exercise 
and those of you who went through and 'decyphered' the 
code are the better for it. The only thing left is to figure 
out how to modify the code so that it always reports the 
'right' results. I found out at this point that the code 
modifies itself a bit more, so we will need to make a few 
more changes to the file, but nothing major. 

I 1 I Copy the original onto the blank with any whole disk 
copier. 

[2~|Boot DOS 3.3 and get into BASIC. 

[T] Insert the original disk in the drive. Make sure it is 
write protected. 

I 4 I Enter the monitor and load the protection code file. 

CALL -151 
BLOAD UPG CODE 

I 5 [ Decode the protection file. 

SAOFG 
7C1FG 

I 6 [ Alter the file so that it forces a correct result. 
7B99:A9 00 was C9 AA 

\ 7 [ Execute the protection code. 
7B06G 

[ 8 [ NOP out the decoding subroutine calls: 

7B00:EA EA EA EA EA EA was 20 OF 5 A 20 IF 7C 

[ 9 [ Take out the original disk and insert the copy. 
[ 10[ Keep a copy of the original protection file. 
RENAME MPG CODE, OLD MPG CODE 

I 11[ Save the now docile protection file. 

BSAVE MPG CODE, A$55FD, L$2630 

You're done! You can replace the DOS on the disk 
with ProntoDOS, if you want faster boot times. 

Playing Tip for... 



Zany Golf 

Electronic Arts 



There is a secret level in the game Zany Golf. To find 
it, first get to the energy level. Now get to the top level 



and fall down through one of the holes (except for the one 
with the flag!). Notice the hole you come out through at 
the bottom level. Every few seconds a pair of 'eyes' 
appear. I leave it to you to figure out what to do now. 

Apple Ilgs + rumors 

I have heard and read quite a bit since last May about 
the rumored upcoming A^jle ngs+ . I thought the readers 
might be interested to hear what I've heard. 

???TheGS+ ??? 

RAM: 512K 'fast', 256K 'slow', 128K dedicated to 
Ensoniq sound chip 

GRAPfflCS: New VGC chip, makes old GS graphics 
look pale. Several new graphics modes 

• 320x200 w/256 colors on screen at once 

• 320x400 w/16 colors 

• 640x200 w/16 colors 

• 640x400 w/4 colors 

SLOTS: New 'invisislots' or 'floating slots', allows a card 
in a slot and built in card for that slot to both be usable 
and active at the same time. For example, you could have 
your hard drive card in slot #4, which is the slot that has 
the built-in mouse card, and use both of them at the same 
time. 

OTHER FEATURES: 

• Built-in SCSI port 

• ADB connector now on side of machine instead of 
back 

• All tools now in ROM for faster boot time 

• Maximum system speed is now 7.8 Mhz. Control 
Panel has three speed settings: NORMAL, FAST, and 
FASTER 

• Control Panel is modified somewhat 

• No dedicated graphics chip 

There is some other info I have read on it, but the 
info above has pretty much stayed steady since I first heard 
about it last May. I also read about ProDOS 16 v2.0 and 
the He 4- at the same time, and they both have appeared 
already. The original ProDOS 16 v2.0 was scrapped, and 
Apple decided it would be a better idea to port over the 
Macintosh's HFS to the GS. The result is GS/OS v2.0. 
The Ilc-f- was at first rumored to be a GS without slots, 
but it turned out to just be a 'He with a Zip Chip' . Another 
rumor that has been going aroimd concerns a K-12 version 
of the Macintosh that Apple will be putting out soon. The 
GS + and the K-12 Mac both seem, in my opinion, to be 
the same conqmter. Wouldn't that be great? Toss in a 1 .44 
meg HDFD 3W drive and you would have the best system 
around. 

Apple's mistake? 

I think that Apple is really making a grave error with 
their recent price increases for the Macs. The MSDOS 
world right now is in disarray, with their different 
operating systems, standards, and program interfaces. 
Apple should be lowering the Mac prices so more and 
more folks would buy them. Market share should be the 
domineering drive at Apple now, not profit margin. Put 
more Macs out there and more people will buy them. This 
leads to more people and companies adopting the Mac as 
a business, home, and educational computer which in turn 
leads to more Mac sales. I work in our local community 
college and I also talk to many, many people about 
computers. Most of them tell me that they really would 
like to get a Macintosh (hear that, Apple?) but the Macs 
cost too much (hear that, Apple?), so these people end 
up getting a cheaper MSDOS clone because they can't 
afford a Mac (hear that, Apple?). 

Let's face it Apple, the price of the Mac is out of reach 
of Joe and Josephene Public. Sure, it's worth the price 
(in my opinion), but they don't care; they want an 
affordable computer that will do the job. Why spend $1800 
on a Mac Plus, when for the same price diey could get 
an MSDOS clone that runs faster, has high resolution 
color, has a 20 meg internal hard drive, and has 640K for 
less money? Come on Apple - 1 don't want the MSDOS 
computers to become the computer standard. The Mac 
would be a much better and more logical standard, but 
the catch is that there have to be a lot more Macs out tiiere 
in use. The home and small business markets, outnumber 
the large business, and Fortune 500 markets, in sheer 
number by such a large margin that it is ridiculous. But 
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where is Aj^le targeting the Mac? Come on Apple, get 
with it and let the average person be able to own the class 
act (along with the Hgs) among computers. Since you are 
the 'only dealer' of the Macs, the ball is in your court. . . 

A better Z^k" drive? 

I have an Apple Hgs with an Apple 3 'A " drive. I also 
have a Central Point 3 '/i " drive. The Central Point drive 
doesn't write as fast, and it's a lot noisier than the Apple 
3 V4 " drive, but it has a few noteworthy advaiitages going 
for it. First of all, it's quite a bit cheaper. An Apple 3 'A " 
drive runs about $400, while the Central Point 3 V4 " drive 
and accompanying Universal Drive Controller card cost 
about $300 (less through mail order). The main advantage 
is the Central Point 3 % " drive's determination in reading 
a disk. If there is an error on a 3 V^ " disk, the Apple 3 ^A " 
drive gives up very quickly and reports an error when the 
bad spot is encountered. The Central Point drive, however, 
tries many times to read the bad spot before it gives up. 
This can be a lifesaver if your disk just happened to write 
a bad checksum for a block for whatever reason. This 
rugged determination has saved a few of my disks and data, 
and I am awfiilly glad I have the Central Point drive. I've 
had the drive for over 2 years now and I haven't had a 
single problem with it. Yes, there is a viable alternative 
to the Apple 3W' drive. 

To Bill Jetzer: The strange 'M=00' that you get on 
your He is indeed not mentioned in the He manual. The 
'M' register is the Machine State Register and tells you 
about the condition of your extended 80 column RAM 
card. It is organized as follows: 

Machine State Register - (0 = clear, 1 = set) 

• Bit 7 - Alternate page of the LC active if set 

• Bit 6 - Page 2 active if set 

• Bit 5 - RAMRD active if set 

• Bit 4 - RAMWRT active if set 

• Bit 3 - ROLCROM active if set 

• Bit 2 - LC bank 2 active if set 

• Bit 1 - Alternate ROMBANK active if set 

• Bit - INTCXROM active if set 

Hope that clears things up for you. Bill. Let me say 
your article in COMPUTIST #60 about reading fi-om 
protected disks was well done. The tables on reading from 
protected DOS 3.2/3.3 and the standard DOS 3.3 RWTS 
locations should be of great help for begiiming Computists. 

To Alan Ziinbard, M.D.: In your letter in 
COMPUTIST #60, you mentioned that the Fingerprint GSi 
card would allow you to go into the monitor, with one 
keystroke frcHn the Fingerprint GSi maiu. I have this card 
and no where in the manual does it even mention the 
feature you described. What keystroke takes you to the 
monitor? I have v2.0 of the card and I've put it into slot 
#3, as instructed in the manual. By the way, Hgs owners 
should look mto getting this card. The screen dump 
ci^bilities are great, and you can edit the screen you want 
to save, as well as save it to disk. Posters as big as 
l(X)'xl30' can be printed out fi-om one graphic screen! 

To Donald Jones: Converting an Appleworks file to 
an ASCn text is not all that hard, but it does take a few 
steps. Here's what to do: 

■ Requirements 

Appleworks program 
Blank formatted DOS 3.3 disk 
Blank formatted ProDOS disk Get's call it /DATA) 
Your word processing file 

DOS 3.3 to ProDOS conversion program, like Copy 
n Plus v6.0 

[ 1 [ Boot Appleworks and load your word processing file. 

[Tl Insert /DATA into a drive. 

I 3 I Press C5 P to print the word processor file. When it 
asks you where to print it, specify 'to an ASCII text file'. 
When it asks you where to print it to, type in 

/DATA/TEXTFILE 

.. .and the file will eventually end up in a ProDOS ASCII 
text file caUed TEXTFILE on the /DATA disk. 

[TJUse your DOS 3.3 to ProDOS conversion program 
to convert and copy the ProDOS ASCII file onto the 
formatted DOS 3.3 disk. 

[T] That's all you have to do! Converting database and 
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spreadsheet files are just the same as converting a word 
processor file. 

• If you 're going thru all that trouble just to send a letter 
to RDEX, don't bother Send it as an Appleworks file on 
ProDOS. We can read those just fine. RDEXed 

To Paul Johnson: You should be able to pick up a 
copy of Beneath Apple DOS from Quality Software 
directly. I bought the book for $19.95. Their address is: 
Quality Software 
21601 Marilla Street 
Chatsworth, CA 91311 

To Bud Myers: If you have any questions on 
deprotection or the Apple computer in general, you can 
always pass a letter my way and I'll see what I can do. 
Also, don't forget to send a copy of the letter to Computist, 
so others can try and help you out too. 

To Andy Borne: The one way I know to load double 
hi-res screens, is with pictures that are saved as two binary 
files. The first file is BLOADed into mam RAM, the 
second file is BLOADed and then moved into auxiliary 
RAM, and then the soft switches are set to display the 
double hi-res screen. The soft switches to set are in your 
extended 80 column card manual. I suggest that you get 
the program Beagle Graphics by Beagle Bros. The manual 
is chock full of goodies for programmers/hackers who 
want to do their own double hi-res programming. 

To Ralph L. Jones: Your ProDOS Sensible Speller 
is not protected any more. The problem you have is that 
the name of a directory that Sensible Speller looks for is 
hard coded instead of being coded relatively. For example, 
Appleworks works fine on any disk, whether it be 5V4 ", 
VA" , RAM disk, or hard disk. That's because it looks 
for it's files all in the same directory, whatever and 
wherever that directory is. It doesn't care where the 
directory is, main or subdirectory, as long as all of the 
files are together in the same directory. Sensible Speller 
expects to find it's files on a disk called /SENSIBLEOOl 
and it will not accept anything else. Now, if you were to 
hunt for all occurences of '/SENSIBLEOOl ' on your 
Sensible Speller disk, and then changed them each to 
'SENSIBLEOOl A', the program would look for the files 
in a subdirectory called SENSIBLEOOl A. 

This subdirectory must be a first level directory, for 
example /HARDDISK/SENSIBLEOOIA or /MASTER 
/SENSIBLEOOIA. When you get a catalog of the main 
directory, the subdirectory name SENSIBLEOOIA must 
be in it. Now, if you want the program to be in a deeper 
subdirectory, then change the original '/SENSIBLEOOl' 
string to whatever you need, for example SENSIBLE/ ABC 
if you want it to look in the subdirectory 
/HARDDISK/SENSIBLE/ABC. The only restriction is 
that the new string has to be the same length as the original 
string. 

Ilgs System monitor commands 

The ngs system monitor contains many commands 
that it's predecessor did not, in addition to having all of 
the old commands too. Here is a list of monitor commands 
that I have been able to dig up. Feel fi-ee to add any that 
I might have missed (there wiU probably be some obvious 
ones) or correct one that I explain incorrectly. If the 
monitor command is unchanged from the pre Ilgs monitor 
conunand, then I'll just say it is the 'SAME as before'. 
Format is: 

Conunand type, keystrokes to activate — conunents on 
command 

• USER command vector, BY — SAME as before. 

• Cold start BASIC, B B — SAME as before. 

• Warm start BASIC, S C — SAME as before. 

• Restore registers, BR — Restore registers to standard 
startup values. 

• Examine registers, BE- SAME as before. 

• Modify registers and flags, (value) = (register or flag) 

— Lets you alter a register or flag's value. Upper or lower 
case is important here. 

• CaU toolbox routine, \(# of bytes on stack) (# of bytes 
off stack) (parni#l . . .parm#N) (function #) (toolset #)\U 

— You really iKed a book with an explanation of the Apple 
Ilgs toolbox to make good use of this command. 

• List code in memory, (bank/address)L — Almost the 
same as the pre Ilgs 'L' command. The status of the 'm' 
and 'x' flags determine the format of the disassembly. 



• Run program in bank zero, (bank/address)G — SAME 
as before. Program must end in a RTS. 

• Run program in any bank, (bank/address)X — Executes 
a program in any memory bank. Program must end in a 
RTL. 

• Move memory, (destination)<(start).(end)M — SAME 
as before. 

• Zap memory, (value)< (start). (end)Z — Fills memory 
range with (vjjue). 

• Verify memory, (destination)<(start).(end)V — SAME 
as before. 

• Change memory, (bank/address): (value) ('inverted 
ASCH') ("literal ASCH") — SAME as before, if you 
enter in (value). "Literal ASCII" is enclosed in double 
quotes. Single quoted 'inverted ASCH' works the same 
as literal ASCH, except that the characters are entered in 
inverse order. 

• Search memory, \(value) ('inverted ASCH') ("literal 
ASCn")\<(start).(end)P — This is my favorite monitor 
command on the Ilgs. You can search memory for a byte, 
series of bytes, or literal ASCH characters. I do not use 
inverted ASCII in my searches at all and, in fact, I wonder 
why it is there. As an example of this command, say you 
want to search for the ProDOS 8 read block command 
(20 00 BF 80) ft-om $800 to $9000 in bank 1. The search 
command you would use is: 

\20 00 BF 80\<01/800.9000P 

If this command is used in conjunction with the visit 
monitor CDA (ROM 01), cracking disks becomes much 
easier. It's kind of like having a poor man's Senior PROM 
in your Ilgs. 

• Set text screen, B T — Sets the screen to text page one. 

• Normal, N — Same as before. 

• Inverse, I — Same as before. 

• Mini-assembler, ! — SAME as before. 

• Change cursor, IscI ' (character) — Lets (character) 
be the cursor. 

• Exit memory range listing, 8 X — Stops the memory 
range listing. 

• Redirect input, (slot#)B K — Connects input hooks to 
(slot#). 

• Redirect output, (slot#)8 P — Connects output hooks 
to (slot#). 

• Dec to hex conversion, = (decimal value) — Converts 
(decimal value) to the hex equivalent. 

• Hex to dec conversion, (hexadecimal value) = — 
Converts (hexadecimal value) to decimal equivalent. 

• Addition, (valuel)-t-(value2) — 32 bit addition. 

• Subtraction, (valuel)-(value2) — 32 bit subtraction. 

• Multiplication, (value l)*(value2) — 64 bit 
multiplication. 

• Division, (valuel)__(value2) — 32 bit division. 

• Display date and time, =T — Displays the date and 
time of your Ilgs system clock. 

• Change date and time, =T=(MM/DD/YYhh:mm:ss) 
— Allows you to change your system clock's time. 

MM = month, range of 1-12 
DD = day, range of 1-31 
YY = year, range of 0-99 
hh = hours, range of 0-23 
mm = minutes, range of 0-59 
ss = seconds, range of 0-59 



Stephen A. Garbaty 



A.P.T. for... 



Lode Runner 

Broderbund 



Lately there have been a few articles published about 
"Enhancing" Lode Runner. The latest was by Paul Kippes 
in COMPUTIST #62. He describes how to get extra men, 
changing levels and changing your score by fixing the 
program code. There is a much easier way to do this, while 
playing the game. Try this: 

8 2 Gives you another guy everytime you press it. 

S 6 Advances you to the next level. 

8 A Restarts current board and reduces man count by 1 . 

B R Restarts game. 

8 S Toggles sound On/Off. 

esc Pauses game 

B U The right arrow wiU speed the game up. 

8 H The left arrow will slow the game down. 



8 E From title screen only, will put you into the editor, 
where you can play any level you like, or even create your 
own levels and store them to a data disk. It also contains 
a few other goodies. 

I have been meaning to write to COMPUTIST for a 
long time, and seeing the challenge at the close of Paul's 
article gave me the motivation. He wanted to know if there 
is any way to stop the screen wipe between each level (The 
iris effect). Well I got to work and disassembled the code. 
After two days of work here's what I found: 

The code starts at $88 A2. ft will be called after the 
level is loaded onto hi-res page 2. It will take the level 
from page 2 and transfer it to page 1 , where you see it 
appear. It also updates the current level and number of 
men on the bottom of the screen, then returns to the game. 
The problems started when I tried to use the monitor move 
routine to take page 2 and place it on page 1. This wiped 
out the information (score,men,level) on the bottom of the 
screen. So I decided to use a monitor routine located at 
$F411. This routine wiU return the base address of any 
hi-res line you leave in the accumulator in address $26 
& $27. By using a loop and transfering that line from page 
2 to page 1 , and then stopping before it overwrites the 
information on the bottom of the screen, you get an instant 
picture. 

Here is the code you need. Enter the monitor, type 
it in, and save it. 



CALL 


-151 


to enter the monitor 


88A2: 


A5 00 48 A5 01 48 


$6940 


88A8: 


A9 40 85 E6 A9 00 8D EC 


$9781 


88B0: 


88 A2 00 A0 00 AD EC 88 


$10D4 


8888: 


20 11 F4 A5 26 85 00 A5 


$253A 


88C0: 


27 38 E9 20 85 01 A0 00 


$170D 


88C8: 


Bl 26 91 00 C8 C0 28 D0 


$35AA 


88D0: 


F7 EE EC 88 AD EC 88 C9 


$F8D3 


88D8: 


80 D0 D6 A9 80 85 E6 20 


$3F0F 


88E0: 


70 7A 20 8C 7A 68 85 01 


$1885 


88E8: 


68 85 00 60 


$3E91 


BSAVE INSTANTPIC, A$88A2, L$4C 





28 



To use it, BLOAD Lode Runner first, then this file, 
then enter the monitor and start Lode Runner with the 
command 5000G. If your copy starts someplace else in 
memory, substitute the proper starting address. You can 
also save the code directly into the program. First BLOAD 
Lode Runner and type in the code, then save it back to 
disk using the proper starting and ending addesses for your 
copy, this will make it permanent. 

Thanks for the challenge Paul, and I hope everyone 
benefits from these tips. IncidentaUy, you can use 
InstantPic in your own programs with slight modifcations. 
Lines $88A2-$88A7 and $88DF-$88EA must be removed 
and you might want to add a time delay to slow it down 
(Located in monitor at $FCA8). Location $88DC holds 
Uie number of lines to transfer from page 2 to page 1. 

Good luck and keep hacking. 



C.E. "Chuck" Garrett 



I really enjoy COMPUTIST and look forward each 
month to its arrival. I have not, as yet, derived much 
benefit, as I am still way down on the learning curve and 
have found no user group or other Apple users to learn 
by talking. I read most of the softkeys mainly to become 
acquainted with the lingo. 

(2) Constant referance is made to "your DOS 3.3 
System Disk". Is this die System Disk that came with 
earlier Apple Computers? Mine is the Ilgs and the original 
System Disk was PtoDOS, which was upgraded by Appple 
to a GS/OS System Disk. If this is so, how may I obtain 
one? 

<2> Frequent reference is also made to 
"COPYA". Is this a commercial copy program such as 
Copy n Plus? I have never seen any ads for it. 

So far the only success I have had, in making back 
up copies of my programs, is by using "Quick and Duty" 
from Locksmith. This is only partially successfiil. For 
example: 

A Q&D copy of Additions Logicians won't load 
completely and therefore won't run. It stops with a partial 
screen display and just shuts down, the boot drive stops 
reading. 

A Q&D copy of Flight Simulator n does exactiy the 
same thing. 

A Q&D copy of Sticky Bear Reading copies but one 
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of the three menu choices will not load. When selected, 
it just sits and the program is then locked and you have 
to re-boot to continue. 

A Q&D copy of Circus Math runs OK, except one 
of the menu choices will not load. This does not lock the 
program and other selections can be made. 

<2> If you can help, by providing answers/ 
solutions to any of the above, I will be grateful. Also, if 
any readers in the Hanford, CA area would like to establish 
a dialogue, I could use the help and will provide any 
limited assistance I am able. 



James A. Hodge 



Softkey for.. 



Calendar Crafter vl.l 

MECC 



To produce a broken version of Calendar Crafter 
perform the following block edit: 

Block Byte(s) From To 



$567 BD 
DF 



B0 26 
00 00 02 



80 20 
A9 27 00 



The protection code is shown below. The program 
reads block 9, compares the first 20 bytes read, then 
expects an I/O error (#$27) when it tries to read block 
8. The above edits change the "BCS $B1B5" to "BRA 
$B1AF" and puts a "LDA #$0027" at $B1AF, just ahead 
of the CLC instruction. This seems to satisfy the protection 
requirements. 

B17DA9 09 00 LDA #0009 

B180 8DBCB1 STA BIBC Bhdrnn. 

B183 22 A8 00 El JSL E100A8 Readblock 9 

B187 22 00 0022 

B189 B6 Bl 01 00 0001B1B6 

B18DB0 26 BCS B1B5 shouldn't branch 

B18F A2 13 00 LDX #0013 

B192BDC0B3 LDA B3C0,X 

B195DDC0B1 CMP B1C0,X check what was read 

B198D01A BNE B1B4 shouldn't branch 

B19A CA DEX 

B19B CA DEX 

B19C 10 F4 BPL B192 

B19E CE BC Bl DEC BIBC set to read Hock 8 (bad Mod) 

BlAl 22 A8 00 El JSL E100A8 try to read it 

B1A5 22 00 0022 

B1A7 B6 Bl 01 00 0001B1B6 

B1AB90 07 BCC B1B4 shouldn't branch 

BIAD C9 27 00 CMP #0027 make sure it was UO error 

B1B0 D0 02 BNE B1B4 if not, set carry, return 

B1B2 18 CLC 

B1B3 60 RTS 

B1B4 38 SEC 

B1B5 60 RTS 

SofOcey for... 



Cbessmaster 2100 vl.Ol 

Software Toolworks 



This is an impressive game, with beautiftil gr^hics 
and just about all the bells and whisdes they could fit on 
a 3V4" disk. It seems to play an excellent game of chess 
too, but I'm no Bobby Fischer. 

The two annoying features are the slow boot time and 
the password protection. 

The slow boot time can be sped up by adding a disk 
cache. The problem is that there are only two free blocks 
on the disk. Nine more blocks can be freed up by deleting 
FINDER files, but that still isn't enough space. The 
easiest, most effective way to gain over 120 blocks of free 
space is to delete all AppleTalk related files in the 
/CMASTERySYSTEM/SYSTEM.SETUP directory. 

{Tlln the /CMASTER/SYSTEM/SYSTEM.SETUP 
directory, delete the following files: ATSETUP, ATINIT, 
ATPATCH, ATSTART, PFILOAD, SPLOAD, 
ATROM, ATRESPONDER 

[T]C(^y a disk cache program into the /CMASTER 
/SYSTEM/SYSTEM.SETUP subdirectory. 

I used the AECACHE.SETUP cache program. With 
a 64K cache, boot time dropped from 2:13 to 1:25, a 



savings of 48 seconds. 

The second problem took me a little more time to 
solve. Password protection is cute for about the first two 
times, and then it becomes annoying. 

The first solution doesn't eliminate the password 
question, but it means you don't need to go leafing through 
the manual to find the password. You need to make sure 
that "Visit Monitor" is installed if you have a Hgs with 
the 01 ROMs, or install something like DiveriHack or the 
"Memory Mangier" desk accessory from the GSDebug 
disk if your Hgs has the 00 ROMs. (Get the upgrade!) 

When the Cbessmaster game gets to the password 
question, go into the monitor by pressing (38 esc and 
selecting the "Visit Monitor" option. Dump memory from 
1750.1780 and you'll see the answer to the question. 
Entering S Y return gets you back to the Control Panel, 
and an additional return gets you back to the game. Answer 
the question and continue normally. 

The second solution to the password nuisance requires 
editing two blocks, but it gets you into the game faster 
because it eliminates the question-and-answer session. 
Perform the following edits: 

Block Byte(s) From To 



$29E 
$5B2 



$187 
$1DE 



C9 02 



82 0A 
6B 



That will do it. Enjoy your chess game. 
Softkey for... 



Crossword Magic 4.0 

Mindscape 



This game had several layers of protection, which 
made it an interesting challenge to crack. 

Using an Apple Ugs with its "Visit Monitor" option 
made the job a lot easier. When you enter the Confrol 
Panel, the registers and stack pointer are saved at 
El/108. lOF (2 bytes each for A, X, Y, and SP), the stack 
is saved at E0/300.3FF, page zero is saved at 
EO/ICOO. ICFF, and the text screen ($400.7FF) is saved 
at E0/1400.17FF. Examining the stack wiU tell you the 
address of the instruction that was executing, and usually 
the stack will reveal a tiail of return addresses. "Visit 
Monitor" is also handy when used in conjunction with a 
sector editor. You can disassemble 16 bit code (m=0 and 
x=0) and you can use the mini-assembler to aiq>ly large 
patches to sectors and blocks. (To find where your 
particular sector/block editor has its buffer, use flie List 
disassembler command. Copy U Plus v8.3 has the SVC 
buffer at $EOO-EFF and the 3V4» buffer at $1100-12FF.) 
Examining the disk with the Cq>y n Plus sector editor 
(with the patch tuition) showed that tracks $00 through 
$0E used FF epilog bytes, and that they had tirack numbers 
different from the actual track locaticm. The Trax option 
in Bag of Tricks revealed that these tracks were all 
numbered 0, some of the sectors had bad checksums, and 
tiie disk had been formatted as volume 0. Tracks $0F to 
$11 were normal. 

The next stq> was to create a controller that would 
copy the original disk to a disk with normal formatting. 
Lines 1015, 1017, 1027 and 1028 in die COTtit)ller allowed 
DOS to ignore track and checksum errors. The controller 
needed two sections, one to copy tracks $00 through $0E, 
and die second section for tracks $0F Arough $11. 

Once I had a normalized disk, I tried booting it. 
Needless to say, it didn't work. It hung in the disk 
confroller code, d found that out from "Visil^onitor".) 
The stage 1 boot code uses the sector read code in the disk 
conti-oller ($C65C-C6FA). The stage 1 boot code had 
stepped the drive arm to ttack 1 but had not set location 
$41 for the disk controller, and it kept failing the track 
test. I was able to insert an instruction to increment location 
$41 so the boot process would continue. 

At this point, stage 1 boot would work, but now the 
disk hung someplace else. The next two problem spots 
were in the stage 2 boot code, specifically die "read 
address" and "read sector data" routines. They were 
looking for FF epilogs, so I changed them to look for normal 
DE AA epilogs. 

The disk would display the first and second tide 
screens and die, so I had to fmd the next step in the 
protection scheme. Once again, "Visit Monitor" to die 
rescue. Stage 2 boot would read frack $02, sector $0B to 
$600 and JSR to it. That code could be seen at 



EO/1600. 16FF with "Visit Monitor". The protection code 
would look for the address header for sector $0E, tiien 
look for a D5. Witiiin $100 bytes of die D5 it would expect 
to find three consecutive E7s, and witiiin $10 bytes of die 
last E7 it expected to find a EE. Then it would copy the next 
6 key bytes to $20-25. AllI had to do was find the values 
for die key bytes. 

I used what I call a "Trojan Horse". I changed die 
JSR $600 that executed the protection code to jump to code 
I suppUed. My routine would wait for a keypress so I could 
insert die original disk, tiien (after a keypress) it would 
proceed to successfully read the key bytes and save them 
in bank 1 memory. 

Once I had the key byte values I placed a litde routine 
into the protection code that would read its own data and 
copy diose values to $20-25. Then it would continue widi 
the last piece of the protection code. 

I now had a game that worked, but there were two 
last ' 'gotcha's" . The printer routine has its own protection. 
Presumably, part of die reason it's diere is to identify 
whether die disk is a data disk or the original disk. 

The printer protection routine is almost identical to 
die routine mentioned above, but it is called twice, looking 
for sectors $07 and $09. The key bytes are copied to 
$3A-41, but only 4 bytes are different die second time 
through. The patch to defeat the printer protection is 
similar in nature to die patch for die general disk 
protection, but it's larger and smarter. It took only 21 bytes 
to defeat the disk protection, but it takes 41 bytes to fix 
the printer routine. 

The lOB included in diis article will make aU the 
changes need to produce a COPYA-able version of 
Crossword Magic 4.0. For tiiose of you who would like 
to save some effort keyuig it in, if you don't mind applymg 
patches widi a sector editor, I've included hex dumps of 
die patches for ti-ack $02, sector $0B (1 1) and ti-ack $0E 
(14), sector $00. If you decide to manually apply the 
patches, you can omit die data values for (t2,sll) and 
(tl4,s0), a total of 248 numbers. 

For die really lazy, die patches for (t2,sll) and 
(tl4,s0) will allow a bit copy to work reliably. Use die 
Patch option in Copy n Plus's sector editor. Set it to 
Custom with FF epilogs, ignore track, ignore data 
checksum, and dien, manual sector copy fracks $00 to $0E 
and perform die necessary edits. Set die Patch option in 
die sector editor to DOS 3.3, and copy fracks $0F to $1 1 
witii manual sector copy. I've also included an AUTO 
PARM for Copy H Plus. 

For die Super lOB sector edit option to work, line 330 
needs to be changed. It's listed widi die confroller. 

Ttack $02, sector $0B patch 

14: A2 05BD23 
18:06 9D20 00CA10F7A0 
20:06D0 48E7FCEEE7FC 
28: EE 

Track $0E (14), Sector $00 patch 

25:C9 07D0 

28: 0C A2 08 6D 43 07 95 39 

30:CA10F8 30 0AA2 03BD 

38: 4C 07 95 3C CA 10 F8 EA 

40:EA18 60FDE7FCE7EE 

48:FCEEEEFCEEE7EEFC 



Controller 
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# ItoadwM Data EXchaniw ft 



330 IF Al < Tl OR Al > PEEK (TRK) THEN NEXT : RETURN 
1000 REM Crossword Magic 4.0 
1010TK = 0:LT = 15:ST = 15:LS = 15:CD = WR:FAST = 1 
1015 POKE 48628,208: POKE 48629,26: REM TRK ERR 
1017 POKE 47405 , 24 : POKE 47406 , 96 : REM CHKSUM 
1020 Tl = TK: GOSUB 170: GOSUB 490: GOSUB 610 
1025 GOSUB 310: RESTORE 

1027 POKE 48628, 173: POKE 48629, 120 

1028 POKE 47405,208: POKE 47406,19 

1030 GOSUB 220 : GOSUB 490 : GOSUB 610 : i F PEEK (TRK) = LT 

THEN 1050 
1040 TK = PEEK (TRK) : ST = PEEK (SCT) : GOTO 1015 
1050 TK = 15:LT = 18:ST = 15:LS = 15:CD = WR:FAST = 1 
1060 Tl = TK: GOSUB 490: GOSUB 610 
1070GOSUB490: GOSUB610: IFPEEK (TRK) =LTTHEN 1090 
1080 TK = PEEK (TRK) : ST = PEEK (SCT) : GOTO 1060 



29 



1090 HOME : PRINT "COPYDONE" : END 

2000 DAJA 255,255,255,255 

2010 DATA71CHANGES, 0,0, 97, 254, 0,0,98, 8, 0,0, 254, 230 

,0,0,255,65 
2020 DATA 1,1, 206, 222, 1,10, 77, 222, 1,10, 87, 170 
2030 DATA 2,11,20,162,2,11,21,5,2,11,22,189,2,11, 

2040 DATA 2,11, 25, 157, 2, 11, 26, 32, 2, 11, 27, 0,2, 11, 28 

,202,2,11,29,16 
2050 DATA 2,11,30,247,2,11,31,160,2,11,32,6,2,11, 

33,208,2,11,34,72 
2060 DATA 2, 11, 35, 231, 2, 11, 36, 252, 2, 11, 37, 238, 2, 11 

,38,231,2,11,39,252 
2070 DATA 2, 11, 40, 238, 9, 0,138, 234, 9, 0,139, 234 
2080 DATA 14, 0,37, 201, 14, 0,38, 7, 14, 0,39, 208 
2090 DATA 14, 0,40, 12, 14, 0,41, 162, 14, 0,42, 8 
2100 DATA 14, 0,43, 189, 14, 0,44, 65, 14, 0,45, 7 
2110 DATA 14, 0,46, 149, 14, 0,47, 57, 14, 0,48, 202 
2120 DATA 14, 0,49, 16, 14, 0,50, 248, 14, 0,51, 48 
2130 DATA 14, 0,52, 10, 14, 0,53, 162, 14, 0,54, 3 
2140 DATA 14, 0,55, 189, 14, 0,56, 74, 14, 0,57, 7 
2150 DATA 14, 0,58, 149, 14, 0,59, 60, 14, 0,60, 202 
2160 DATA 14,0,61,16,14,0,62,248,14,0,63,24 
2170 DATA 14, 0,64, 96, 14, 0,65, 253, 14, 0,66, 231 
2180 DATA 14, 0,67, 252, 14, 0,68, 231, 14, 0,69, 238 
2190 DATA 14, 0,70, 252, 14, 0,71, 238, 14, 0,72, 238 
2200 DATA 14, 0,73, 252, 14, 0,74, 238, 14, 0,75, 231 
2210 DATA 14,0,76,238,14,0,77,252 

Checksums 



330 
1000 
1010 
1015 
1017 
1020 
1025 
1027 
1028 
1030 
1040 
1050 
1060 



$4A8D 
$FC06 
$9644 
$803D 
$8BE1 
$76B0 
$3EC6 
$0384 
$C83B 
$F5B7 
$48AE 
$C9D8 
$53B4 



1070 
1080 
1090 
2000 
2010 
2020 
2030 
2040 
2050 
2060 
2070 
2080 
2090 



$605D 
$AAAA 
$7D80 
$D1A8 
$DE44 
$8FC8 
$8B27 
$89A3 
$9CFC 
$7B60 
$0C6D 
$F5CF 
$4792 



2100 
2110 
2120 
2130 
2140 
2150 
2160 
2170 
2180 
2190 
2200 
2210 



$9F92 
$9562 
$D99E 
$493E 
$646B 
$9717 
$F187 
$2201 
$4C2E 
$73BC 
$1B92 
$9500 



Auto parms for Copy II Plus 

T0-T1, SECTOR COPY, 5C=FF, 5D=FF, 66=FF, 67=FF 

T2, SECTOR COPY, 5C=FF, 5D=FF, 65=00, 66=FF, 67=FF 

SECTOR ED I T , TRACK 2 , SECTOR 0B , DOS 3 . 3 , 

14:A2/05/BD/23/06/9D/20/00/CA/10/F7/A0/06/D0/48/ 

E7/FC/EE/E7/FC/EE 

T3-TE, SECTOR COPY, 5C=FF, 5D=FF, 65=FF, 66=FF, 67=FF 

SECTOR ED I T , TRACK E , SECTOR 00 , DOS 3 . 3 , 

25 : C9/07/D0/0C/A2/08/BD/43/07/95/39/CA/10/F8/30// 

OA/A2/03/BD/ 

4C/07/95/3C/CA/10/F8/EA/EA/18/60/FD/E7/FC/E7/EE/ 

FC/EE/EE/FC/EE/E7/EE/FC 

TF-Tll, SECTOR COPY, 5C=DE, 5D=AA, 66=DE, 67=AA 

Softkey for... 



Dive Bomber 

Epyx 



This game has the "standard" Epyx protection 
scheme. They scan a track for a particular pattern of bytes 
and when they find them, they copy the key bytes that 
follow the pattern down to page zero. Then the key bytes 
are Exclusive OR'ed with another couple of pages of bytes 
to produce usable code. Then the boot process continues. 

Just use the controller to ci-eate a COPYA-able copy 
of Dive Bomber. 



Controller 

330 I F Al < Tl OR Al > PEEK (TRK) - 1 THEN NEXT : RETURN 

1000 REM EPYX DIVE BOMBER 

1010 TK = 0: LT = 35:ST = 15:LS = 15:CD = WR:FAST = 1 

1020 Tl = TK: GOSUB 170: GOSUB 490: GOSUB 610 

1025 60SUB 310: RESTORE 

1030 GOSUB 230 : GOSUB 490 : GOSUB 610 : I F PEEK (TRK) = LT 

THEN 1050 
1040 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1020 
1050 HOME : PRINT "COPY'DONE." : END 



2000 DATA 255,255,255,255 

2010 DATA 14^ CHANGES, 0,9, 43, 169, 0,9, 44, 231, 0,9, 45 

,133,0,9,46,248 
2020 DATA 0,9,47,169,0,9,48,252,0,9,49,133,0,9,50 

,249,0,9,51,169 
2030 DATA 0,9,52,238,0,9,53,133,0,9,54,250,0,9,55 

,208,0,9,56,67 

Checksums 



330 - $DD80 
1000 - $7DD7 
1010 - $394C 
1020 - $9E5D 



1025 - $D6BB 
1030 - $E322 
1040 - $6B0B 
1050 - $E347 



2000 - $B953 
2010 - $6D9B 
2020 - $58C3 
2030 - $36C9 



ProDOS EOR Disk Scanner 



In Computist #57 Phil Goetz presented a program to 
scan a 5 '/4 " floppy for data that had been encrypted by 
EOR'ing it with some constant value. The only drawback 
was that it didn't work on 3'/i" ProDOS disks. 

I needed a program for ProDOS, so I adapted Phil's 
program. This should be able to work on any I>roDOS 
volume. I know it works on 3W and 5'/4" disks. 

Since ProDOS tends to store files in ascending blocks, 
I felt the option to scan down wasn't needed. Otherwise, 
this program behaves the same way as the original. 

To use it, enter the length of the pattern you want to 
search for at $300 and the search pattern at $301. Then, 
BRUN PROSCAN, or, if the program is already in 
memory, execute it with a 2000G. 

Matches are reported with the message 'BL$1234 
OlDFrCO', which would mean a match was found for your 
search string in block $1234 starting at byte $01DF, and 
the string had to be EOR'd with $C0 to match. 

The device to be searched can be set in byte $2189. 
To access different drives set $2189 as follows: 

slot 6, drive 1 - $60 

slot 6, drive 2 - $E0 

slot 5, drive 1 - $50 

slot 5, drive 2 - $D0 

Change bytes $2185-2186 for the maximum number 
of blocks. ProDOS 8 limits the maximum value to $FFFF. 
If you need to scan a device with more than 32 megabytes, 
simply convert the program to ProDOS 16. Use $1 18 or 
$640 for 5W" and 3'/^", respectively, and enter them in 
the lo-byte hi-byte format (IE. 18 01 or 40 06). 

I used the Merlin 8/16 Assembler to create the source 
code. The generated object code should make it easy to 
produce identical code even if you're using a different 
assembler. A hex dump of ProSCAN is also included. 





1 


*PmDOS EOR M scanner 




2 


*ahfttd by James A. Hodge from 




3 


*iie DOS 5.S version by MGoeti 




4 
5 
6 


*fub. Qmpu^ 57 


=0024 


OH 


= 


$0024 


=0025 


7 


CV 


= 


$0025 


=0300 


8 


LEN 


= 


$0300 


=0301 


9 
10 


STRING 


= 


$0301 


=2200 


11 


BUFFER 


= 


$2200 


=BF00 


12 
13 


MLI 


= 


$BF00 


=fl00 


14 


KEY 


s 


$C000 


=0010 


15 
16 


STROBE 


= 


$0010 


=DB3A 


17 


STROUT 


= 


$DB3A 


=F941 


18 


PRNTAX 


= 


$F941 


=FB2F 


19 


INIT 


= 


$FB2F 


=FC22 


20 


VTAB 


= 


$FC22 


=FD8E 


21 


GROUT 


= 


$FD8E 


=FDDA 


22 


PRBYTE 


= 


$FDDA 


=FDF0 


23 


COUTl 


= 


$FDF0 


=FE84 


24 


SETNORM 


= 


$FE84 


=FE89 


25 


SETKBD 


= 


$FE89 


=FE93 


26 
27 


SETVID 


= 


$FE93 




28 




TR 


ADR 




29 




ORG $2000 




30 








2089FE 


31 




JSR SETKBD 



SCAN start 



2003: 2093FE 


32 


JSR SETVID 




2006: A9 01 


33 


LDA #$01 




2008: 8D7D21 


34 


STA FLAG 


tei gei>yte to read sec. 


200B: A900 


35 


LDA #$00 


make sure stuff is 


200D: 8D8C21 


36 


STA BLOCK 


imtiaH^M property 


2010: 8D8D21 


37 


STA BLOOK+1 




2013: 8D8121 


38 


STA PTR 




2016: 8D87 21 


39 


STA Zorl 




2019: 20 8EFD 


40 


JSR OROUT 




2010: 2008 20 


41 
42 
43 GO 


JSR PRNJL 




201F: A2 00 


LDX #$00 




2021: 8E7F21 


44 


STX MIND 


naidi index 


2024: AD 00 03 


45 


LDA LEN 




2027: 8D7E21 


46 


STA LEN2 


counsdomtomatdi 


202A: AD 81 21 


47 


LDA PTR 




202D: 8D80 21 


48 


STA MSTART 




2030: AD 80 21 


49 


LDA BLOCK 




2033: 8D82 21 


50 


STA BLK0 




2036: AD8D21 


51 


LDA BLOOK+1 




2039: 8D83 21 


52 


STA BLK0+1 




2030: 20 DC 20 


53 LI 


JSR GETBYTE 




203F: B0 7B=20BC 


54 


BOS SoLong 




2041: AE7F21 


55 


LDX MIND 


matd index 


2044: D0 08=204E 


56 


BNE L2 




2046: 48 


57 


PHA 




2047: 4D0103 


58 


EOR STRING 




204A: 8D7021 


59 


STA EOR 




204D: 68 


60 


PLA 




204E: 5D0103 


61 L2 


EOR STRING,X 




2051: CD 70 21 


62 


OMP EOR 




2054: D0 35=208B 


63 


BNE L3 




2056: EE7F21 


64 


INO MIND 


match inda 


2059: CE7E21 


65 


DEO LEN2 


countdown to match 


2050: D0DE=203O 


66 
67 
68 


BNE LI 


if no match 


205E: AD 83 21 


LDA BLK0+1 


Complete match 


2061: AE82 21 


69 


LDX BLK0 




2064: 20D5 20 


70 


JSR PRN_BLK 




2067: A9 0A 


71 


LDA #10 




2069: 85 24 


72 


STA OH 




2068: AD 87 21 


73 


LDA Zorl 




206E: AE80 21 


74 


LDX MSTART 




2071: 2041F9 


75 


JSR PRNTAX 


print 2 byte address 


2074: A9BA 


76 


LDA#":" 




2076: 20F0FD 


77 


JSR OOUTl 




2079: AD 70 21 


78 


LDA EOR 




2070: 20DAFD 


79 


JSR PRBYTE 




207F: 2008 20 


80 


JSR PRNJL 




2082: AD8D21 


81 


LDA BLOCK+1 




2085: AE8021 


82 


LDX BLOCK 




2088: 20D5 20 


83 
84 
85 *Goback 


JSR PRNJLK 






& start at byte after beginning of 




86 * te marc/i attempt, see if we need to go 




87 *back a sector. 






88 






208B: AO80 21 


89 L3 


LDY MSTART 




208E: 08 


90 


INY 




208F: F0 25 =2086 


91 


BE0L5 




2091: 008121 


92 


OPY PTR 




2094: 90 20=2086 


93 


B00L5 




2096: AD 81 21 


94 


LDA PTR 




2099: F0 IB =2086 


95 


BEQL5 




2098: AD 87 21 


96 


LDA Zorl 


ifZorl=0, just toggle 


209E: F00F=20AF 


97 


BEQL4 


Indhalfofblod 


20A0: AD 82 21 


98 


LDA BLK0 




20A3: 8D8021 


99 


STA BLOCK 




20A6: AD 83 21 


100 


LDA BLK0+1 




20A9: 8D8D21 


101 


STA BLOCK+1 




20AO: 2063 21 


102 


JSR GETBLOK 




20AF: 20 52 21 


103 L4 


JSR TOGGLE 




20B2: AO80 21 


104 


LDY MSTART 




2085: 08 


105 


INY 




20B6: 808121 


106 L5 


STY PTR 




20B9: 40 IF 20 


107 
108 


JMPGO 




2080: AD 10 00 


109 SoLong 


LDA STROBE 




20BF: 2084FE 


110 


JSR SETNORM 


set normal video 


2002: 20 2FFB 


111 


JSR INIT 




2005: 4OD003 


112 
113 


JMP $3D0 


So long 


2008: A021 


114 PRN_BL 


LDY #>BLODR 




20OA: A96D 


115 


LDA #BLKJDR 
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20CC 
20CF 
20D1 
20D4 

20D5 
20D7 
20D9 

20DC 
20OF 
20E1 
20E3 
20E5 
20E7 
20EA 
20EC 
20EF 
20F2 
20F4 
20F7 
20FA 
20FB 



20 3ADB 
A5 25 
80 84 21 
60 

A0 03 
84 24 
4C 41 F9 

AD00C0 

C9A0 

F0F9=20DC 

C9 9B 

F0 69 =2150 

AC 81 21 

[)008=20F4 

AD 80 21 

0D7D21 

D0 08 =20FC 

B9 00 22 

EE8121 

18 



20FC: AD7D21 
20FF: 0005=2106 
2101: 20 52 21 
2104: D0EE=20F4 
2106: A084 21 
2109: 85 25 
210B: 2022FC 
210E: A000 
2110: 8C70 21 
2113: EE8C21 
2116: O0 03=211B 
2118: EE8021 
21 IB: A0 8C21 
211E: CO 85 21 
2121: 0008=2128 
2123: AD 80 21 
2126: CD 86 21 
2129: F0 25 =2150 
212B: A08D21 
212E: AE8C21 
2131: 20 05 20 
2134: 20 63 21 
2137: A000 
2139: 90B9=20F4 
213B: A0 21 
2130: A9 72 
213F: 20 3AO6 
2142: A08E21 
2145: 20DAFO 
2148: 20C8 20 
214B: 4CFC20 

214E: 18 
214F: 60 

2150: 38 
2151: 60 

2152: AOF6 20 
2155: 49 01 
2157: 8DF6 20 
215A: A087 21 
2150: 49 01 
215F: 8087 21 
2162: 60 



2163 
2166 
2167 
2169 
216C 

2160 
216E 
2171 

2172 
2176 
217A 
217B 



20 00 BF 
80 

88 21 
80 8E 21 



80 
C2CCA4 



A0A0A0C5 
D2D2A0A3 
A4 



116 

117 

118 

119 

120 

121 PRNJLK 

122 

123 

124 

125 GETBYTE 

126 

127 

128 

129 

130 

131 

132 

133 

134 

135 GETBYTl 

136 

137 

138 

139 

140 NEWSEC 

141 

142 

143 

144 NSEC 

145 

146 

147 

148 

149 

150 

151 

152 NSECl- 

153 

154 

155 

156 

157 

158 NSEC2 

159 

160 

161 

162 

163 

164 

165 

166 

167 

168 

169 

170 

171 

172 

173 

174 

175 BYE 

176 

177 

178 TOGGLE 

179 

180 

181 

182 

183 

184 

185 

186 GETBLOK 

187 

188 

189 

190 

191 

192 BLKJOR 

193 

194 

195 

196 ERRMSG 



JSR STROUT 
LDACV 
STA VERHAB 
RTS 

LDY #$03 
STYCH 
JMP PRNTAX 

LOA KEY 
CMP #$A0 
BEQ GETBYTE 
CMP #$9B 
BEO BYE 
LOY PTR 
BNE GETBYTl 
LOA MSTART 
ORA FLAG 
BNE NEWSEC 
LDA BUFFER, Y 
INC PTR 
CLC 
RTS 

LOA FLAG 
BNE NSEC 
JSR TOGGLE 
BNE GETBYTl 
LOA VERHAB 
STACV 
JSR VTAB 
LOY #$00 
STY FLAG 
INC BLOCK 
BNE NSECl 
INC BLOCK+1 
LOA BLOCK 
CMP MAXBLOX 
BNE NSEC2 
LOA BLOCK+1 
CMP MAXBLOX+1 
BEQ BYE 
LDA BLOCK+1 
LOX BLOCK 
JSR PRNJLK 
JSR GETBLOK 
LDY #$00 
BCC GETBYTl 
LDY #>ERRMSG 
LDA #ERRMSG 
JSR STROUT 
LDA ERROR 
JSR PRBYTE 
JSR PRN_BL 
JMP NEWSEC 

CLC 
RTS 

SEC 
RTS 

LDA GETBYTl+2 

E0R#1 

STA GETBYTl+2 

LDA Zorl 

E0R#1 

STA Zorl 

RTS 

JSR ML I 
HEX 80 
DA PARMS 
STA ERROR 
RTS 

HEX 80 
ASC "BL$" 
HEX 00 

ASC " ERR #$" 



pause 
ait on escape 



if no error 



toggle YMdi hdf 
ofbi^r 
to access 



READBWCK 



three spaces 



217C 
2170 
217E 
217F 
2180 
2181 
2182 
2184 
2185 
2187 

2188 
2189 
218A 
218C 
218E 



18 01 



03 
60 
00 22 



198 

199 EOR 

200 FLAG 

201 LEN2 

202 MIND 

203 MSTART 

204 PTR 

205 6LK0 

206 VERFTAB 

207 MAXBLOX 

208 Zorl 
209 

210 PARMS 

211 

212 

213 BLOCK 

214 ERROR 



HEX 00 
HEX 00 
HEX 00 
HEX 00 
HEX 00 
HEX 00 
HEX 0000 
HEX 00 
OW 280 
HEX 00 

HEX 03 
HEX 60 
DA BUFFER 
OS 2 
HEX 00 



EOR byte 

countdown to matdi 

nuttdi index 

natch start index 

rintoMer 



msoRm 



mit ± = DSSSm 



End Me r 11 n-16 assembly, 399 bytes, errors: 
ProScan Hex Dump 



2000: 20 89FE 
2008:80 70 21 
2010: 8D8D21 
2018: 2120 8E 
2020:00 8E7F 
2028: 7E21AD 
2030: AD 80 21 
2038: 218D83 
2040: 7BAE7F 
2048: 0103 8D 



20 93 FE A9 01 
A9 00 80 80 21 
8D81218D87 
FD 20 08 20 A2 

21 AD 00 03 80 
81 21 8D 80 21 
8D 82 21 AD 80 
21 20 DC 20 B0 
21 00 08 48 40 
70 2168 50 01 



2050: 03 
2058: 21 
2060: 21 
2068: 0A 
2070: 21 
2078: FD 
2080: 08 
2088: 20 
2090: 25 
2098: 21 



CD 70 21 
CE 7E 21 
AE 82 21 
85 24 AD 
20 41 F9 
AD 70 21 
20 AD 80 
05 20 AC 
CO 81 21 
F01BAD 



00 35 EE 7F 
00 DE AD 83 
20 05 20 A9 
87 21 AE 80 
A9 BA 20 F0 

20 DA FD 20 

21 AE 80 21 
80 21 08 F0 
90 20 AD 81 
87 21 F0 0F 



20A0: 
20A8: 
20B0: 
2088: 
2000: 
2008: 
2000: 
2008: 
20E0: 
20E8: 

20F0: 
20F8: 
2100: 
2108: 
2110: 
2118: 
2120: 
2128: 
2130: 
2138: 

2140: 
2148: 
2150: 
2158: 
2160: 
2168: 
2170: 
2178: 
2180: 
2188: 



AO 82 21 80 80 
21 80 80 21 20 
52 21 AO 80 21 
21 40 IF 20 AO 
84 FE 20 2F FB 
A0 21 A9 60 20 
25 80 84 21 60 
24 40 41 F9 AD 
A0 F0 F9 09 9B 
81 21 00 08 AO 



21 AD 83 
63 21 20 
08 80 81 
10 00 20 
40 00 03 
3A0BA5 
A0 03 84 
00 00 09 
F0 69 AC 
80 21 00 



70 21 00 
81 21 18 
05 20 52 
2185 25 
80 70 21 
EE80 21 
21D0 08 
21F0 25 
21 20 05 
00 90 B9 



08 B9 00 22 EE 
60 AO 70 21 00 
21 00 EE AO 84 
20 22FOA0 00 
EE 80 21 00 03 
AO 80 21 00 85 
AO 80 21 00 86 
AO 80 21 AE 80 
20 20 63 21 A0 
A0 21 A9 72 20 



3A0BAD8E21 

20 08 20 40 FO 
38 60 AD F6 20 
F6 20 AD 87 21 
87 21 60 20 00 

21 80 8E 21 60 
A4 00 A0 A0 A0 
A0 A3 A4 00 00 
00 00 00 00 I 
03 60 00 22 I 



20 DA FD 
20 18 60 
49 01 80 
49 01 80 
BF 80 88 
80 C2 00 
05 D2 D2 
00 00 00 

i 18 01 00 

'00 00 



$242F 
$068B 
$B0B4 
$6060 
$0464 
$07EE 
$6B4B 
$90AF 
$F840 
$7021 

$9E01 
$EB6E 
$53F6 
$5575 
$3E61 
$E6A4 
$70A9 
$0CBD 
$000A 
$3F32 

$E6DF 
$597D 
$304E 
$7B4F 
$8821 
$0098 
$8780 
$A506 
$0045 
$O5E0 

$7537 
$0934 
$8F9B 
$EB75 
$A0O4 
$BF3E 
$EB60 
$D6D1 
$4117 
$8F33 

$653F 
$0300 
$9702 
$6918 
$2E2E 
$A1D5 
$6926 
$0A81 
$08EO 
$084B 



Softkey for... 



Scrabble 

Electronic Arts 



197 



HEX 00 



Here's a game that never should have made it past 
the beta test phase. Actually, it never should have made 
it to the beta test phase. This game demonstrates the level 
of British quality control that destroyed their motorcycle 
industry and did extensive damage to their auto industry. 
Apparendy, Leisure Genius is a reference to the game's 



programmers. 

While it plays a good game of Scrabble, it has the 
extremely annoying flaw of constantly recalibrating the 
disk drive. This game needs to be broken to be fixed. 

The disk actually has two DOS systems on it. Both 
are modified DOS 3.3. The boot DOS looks like a fairly 
complete 48K DOS, but with most of its routines, and their 
entry points, moved around. It's modified enough that a 
controller using a "SWAP RWTS" isn't practical. The 
other DOS is loaded with the game, and it is relocated 
to $B400. It consists of most of the RWTS code, and a 
few routines to read and write the catalog, and load and 
save the dictionary and save game files. It also has a lot 
of dead, apparently unused, code, as does the rest of the 
game. 

If I had sent COMPUTIST this article when I finished 
it, it probably would have been published before the 
Scrabble article by Edward Teach (COMPUTIST ^3, pg. 
30). He didn't mention the copyright date, but it appears 
that his version of Scrabble may have been different from 
mine, because the hello program is a different length and 
he didn't mention anything about the disk drive 
recalibration problem. His technique for capturing the files 
should work, with minor modifications, on a Ilgs, but his 
Super lOB didn't work with my copy of Scrabble. 

The specific version that I broke has copyright dates 
of 1984, 85, 86 and 87, but I suspect that any other 
versions will be very similar. 

To produce a broken version of the game requires a 
48K or 64K Apple that. will allow you to reset into the 
monitor, an Apple Die or He with 128K, a Ilgs with the 
01 ROMs and "Visit Monitor", or a Ilgs with Diversi- 
Hack. (Let's see now; I guess that about covers it.) 

Cracking Scrabble on a 48K or 64K Apple II + . 

You need to be able to RESET into the monitor, either 
with an old Monitor ROM (pre- Autostart), a modified F8 
ROM, or a non-maskable interrupt card (e.g., Wildcard 
or Snapshot). 

I 1 I Boot the Scrabble disk. When the title screen appears 
and the disk drive stops spinning, drop into the monitor. 

I 2 I Move the Applesoft hello program to a safe area of 
memory and note the program length. 

4000<800.DOOM 

AF.BO note these values - OOAF- 25 OOBO- OB 

|T]Boot a "HELLO-less" slave disk. 
C600G 

I 4 I Get into the monitor and move the hello program back 
to $800. 

CALL-151 
800<4000.4400H 
AF:25 OB 

ec 



use the AF.BO values noted in Step 2 
back to BASIC 



I 5 I Save the hello program and the tide screen. 

SAVE HELLO 

BSAVE SCRABTIT,A$2000,L$1FFF 

I 6 [ Boot the Scrabble disk. When the Scrabble board 
appears, drop into the Monitor. 

2000<B400.BEFFM 

I 7 I Boot the slave disk and capture the second part of the 
program. 

C600G 

BSAVE SCRABBLE.2, A$2000, L$63FF 

I 8 [ Boot the Scrabble disk agaip. When the Scrabble 
board appears, drop into the Monitor again. 

2000<800.1FFFM 

I 9 [ Boot the slave disk, re-assemble, and BSAVE the 
program. 

C600G 

CALL-151 

800<2000.37FFM 

BLOAD SCRABBLE.2 

BSAVE SCRABBLE, A$800, L$7BFF 

I 10| Copy the four data (dictionary) files from the original 
disk to the new disk with FID or Copy n Plus. 



COIiPUnST #66 



< Raatieni Data Exchange < 



31 



The files are: 
D-USA-1 
D-USA-2 
D-USA-3 
D-USA^ 

If the file "D-USA-3" won't copy, then it can be 
captured by the following method: 

CALL -151 
BLOAD SCRABBLE 

Put the Scrabble disk into the drive. 

300:A9 03 20 00 B4 60 N 7E44G N 300G 

When the drive stops, you may have to hit RESET. 
Get back into the Monitor, and move the data to a safe 
place: 

4000<8AOO.A2FFM 

Boot the slave disk, and: 

C600G 

BSAVE D-USA-3,A$4000,L$18DB 

The HEUX) file needs some editing. I'll explain that 
later. 

Cracking Scrabble on a 128K lie, lie or 

Ilgs with rev. ROMs. 

There are a couple of methods for booting a disk into 
auxiliary memory. One was originally published in 
COMPUTIST #16, in the article "Secret Weapon: 
Ramcard", by Ken Greenlaw. An elegant refinement of 
the XFER.BOOT and RESTORE techniques was 
published in COMPUTIST #58, in the RDEX article 
"Cracking on the He", by Zorro. That is the method I'll 
demonstrate. 

I 1 I Boot a slave disk. Then enter the monitor and set up 
to boot the Scrabble disk into auxiliary memory. 

PR#3 switch in the 80 cobmn firmware 

CAU-151 

0: 8D 03 CO 8D 05 CO 4C 00 C6 

I 2 I Insert the Scrabble disk in the drive and enter. 
OG 

I 3 I The drive will run for a while as the hello program 
and title screen are loaded. When the drive stops, hit 
RESET. Now, setup to move aux. memory to main 
memory. 

CALL-lSl 

300:18 4C 11 C3 

3F8: 4C 00 03 set up control-Y vector 

800<800.3FFFBY 

AF<AF.B08Y 

8C 

SAVE HELLO 

BSAVE SCRABTIT, A$2000, L$1FFF 

I 4 I Enter the monitor and set up to boot the Scmbble disk 
into auxiliary memory again. 

PR#3 

CAU-151 

0: 8D 03 CO 8D 05 CO 4C 00 C6 

I 5 I Insert the Scrabble disk in the drive and enter. 
OG 

I 6 I The drive will run for awhile as the hello program 
and title screen are loaded, then it will run again to load 
the Scrabble program. When the drive stops the second 
time, hit RESET. Now, move auxmem to main memory: 

800<800.83FFSY 

2000<B400.BEFFSY 

BSAVE SCRABBLE,A$800,L$7BFF 

I 7 I See step 10 from the m- crack to capture the data 
files. 

All the files you'll need are now on an unprotected 
disk, but a little more work is needed. I'll e:^plain that after 
I detail how to deprotect Scrabble on a Ilgs. 

Cracking Scrabble on a Ilgs with 01 ROMs 

or 00 ROMs and DiversiHack. 

This is die easiest way to crack Scrabble, and iHX>bably 
the best. 



If you have a Ilgs with the 01 ROMs, there is a desk 
accesssory called "Visit Monitor", which is installed by 
getting into the monitor and entering: # return. If you then 
get into the control panel, you'll see that two new desk 
accessories have been installed. 

If you have the 00 ROMs in your Ilgs, you'll need 
DiversiHack or a similar desk accessory that will allow 
you to get into the monitor from the Control Panel. 

I 1 [ Boot Scrabble. When the drive stops, get into the 
control panel, and then into "Visit Monitor", and move 
main memory to a safe location. 

1/800<0/800.4000M 

O/AF.BO note these vdues 

I 2 I Put a slave disk in the drive and reboot. Get into the 
monitor and set up to save the hello program and title 
screen. 

C600G 

CALL-151 

0/800<l/800.4000M 

0/AF:25 OB 

8C 

SAVEHEUO 

BSAVE SCRABTIT, A$2000, L$1FFF 



use the vahtes noted in step 1 



I 3 I Boot the Scrabble disk again. When the drive stops 
after displaying the title screen, get into "Visit Monitor" 
again. 

800.B80 display memory, look for BRUN, note its start address 
7F = F set system mask to clear hi-bit 

B0F:"BLOAD" change BRUN to BLOAD. if $BOF was start 

address of BRUN 
8Y exit Control Panel to program 

I 4 [ The HELLO program will continue executing, but 
it will BLOAD, instead of BRUN, Scrabble. When the 
drive stops. Scrabble is loaded. You may get a "Syntax 
Error" message, but it can be ignored. Go into "Visit 
Monitor" again and move Scrabble to bank 1. 

l/800<0/800.83FFM 

I 5 I Boot the slave disk, and then move Scrabble back to 
bank memory. 

C600G 

CALL-151 

0/800<l/800.83FFH 

BSAVE SCRABBLE, A$800, L$7BFF 

I 6 I Follow step 10 from the II -h section to get the data 
files. 

Modifying the HELLO program 

By now ybtr'should have seven files tMi your disk; 
HELLO, SCRABTIT, SCRABBLE, D-USA-1, D-USA-2, 
D-USA-3, D-USA-4. 

The HELLO program needs to be changed to work 
with the deprotected files. 

The files SCRABTIT and USA-SCRABBLE 
originally had EC's as die second characters in their names. 
Copying over lines 30 and 80 in the HELLO program will 
remove the invisible control characters. If you have called 
the game file "SCRABBLE' ' instead of its original name 
"U BC SA-SCRABBLE", change the name in line 80. 

There are several delay loops in the HELLO program, 
in lines 46, 56, 67, and 73. Loading will go much faster 
if you shorten them or eliminate them altogether. 

Don't forget to save HELLO after you're finished. 

Fixing Scrabble's DOS 

When this game was programmed, there must have 
been several people working on it. Unfortunafly, they 
didn't talk to one another to find out who was using what 
area in memory. As a result, there is a conflict (more than 
one, but only one that really counts) over the use of address 
$AD02. That is supposed to be tiie last track accessed, 
but it gets stepped on by a routine in the game. 

To fix the DOS so it doesn't constantly recalibrate the 
disk drive, all you have to do is change the six references 
to $AD02 to a safe address, like $B302. That means only 
one byte needs to be changed in six locations. The disk 
will still recalibrate itself once at the start of the game 
unless you make an additional change. 

To fix it: 



BLOAD SCRABBLE 

CALL-151 

2258:B3 

2417:B3 

2422:B3 

2430:B3 

2437:B3 

2463:B3 

7FD:20 00 2A 

2A00:AD EC B7 OA 8D 02 B3 60 

BSAVE SCRABBLE, A$7FD, L$7C02 

That's all there is to it. You should now have a 
deprotected version of Scrabble that runs quietly. 

Converting Scrabble to ProDOS 

The best way to deal with Scrabble's DOS is to get 
rid of it altogether. The only advantage to the original DOS 
is that you can run it on a 48K machine. (Who cares?!) 

The advantage in converting to ProDOS is mainly 
speed. ProDOS can use the /RAM volume for additional 
speed and silence, and decreased wear of the disk drive. 
The following chart shows the relative clockings for 
Scrabble, when it is set so the computer will play against 
itself. 

DOS 3.3 - approx. 57 min. 

ProDOS (disk based) - approx. 26 min. 

ProDOS (ram disk) - approx. 15 min. 

Times are approximate because they vary due to the 
random selection of letters. If a "player" (the computer) 
gets a good selection of letters, "his" turn will go fast. 
Tlie times still indicate a clear speed advantage for the 
ProDOS version. With a speedup card, or a Ilgs set at 
fast speed, the ProDOS ram disk time drops to less than 
5 minutes. 

The conversion is pretty straightforward. First, 
transfer the following files to a ProDOS disk; D-USA-1 , 
D-USA-2, D-USA-3, D-USA-4, HELLO, SCRABTIT, 
SCRABBLE. 

The disk should be named /SCRABBL. During file 
transfer, the dashes (-) in the dictionary file names will 
be converted to periods (.). Copying the dictionary files 
over to the ProDOS disk first should make it easier for 
the game to access them. You canusea5'A"or3%" disk. 

The Scrabble game needs a couple of modifications 
to work in the ProDOS environment. The following code 
needs to be installed. 

The first listing is the ProDOS interface ("SDOS"), 
and the second listing ("SPATCH") is code to r^lace 
the original DOS relocate code and a bitmap clearing 
routine. 

You can either enter the assembly listing and ass«nble 
the code, or enter the hex dump directly into memory. 
If you choose to enter tbe hex dun^, save both files, the 
first as "SDOS, A$206o, L$26C", and the second as 
"SPATCH, A$7E44, L$30 ". 

To install the new code: 

BLOAD SCRABBLE 

BLOAD SDOS,A$2000 

BLOAD SPATCH 

BSAVE SCRABBLE, A$800, L$7BFF 

At this point you should have a working, disk based, 
ProDOS version of Scrabble. You may have to add a line 
to the "original" HELLO program to set the prefix to 
/SCRABBL. 

To create a ram disk version, enter the Applesoft 
listing, and use it to start up the game. You need at least 
a 128K He or He for the ram disk version. 



EH 



1 

2 
=00C03 


* SanMk ProDOS by Jam A. Hodge 


Create = 


$00 


=00C84 


Open 


$08 


=00(^5 


Read 


$0A 


=00CB6 


Write = 


$CB 


=00CC7 


Olose = 


$00 


=BF008 
9 
=080010 


MLI 


$BF00 


H0800 = 


$0800 


=080011 


H080C = 


$0800 


12 






=403613 


Prnt_ines= 


$4036 


=500614 


Get Jey = 


$5006 


=790015 


SaveJM = 


$7900 


=790F16 


RestJW = 


$790F 


coiiPinnsT MS 1 



5:4C17B4 
B403:4C42B5 
B406:4C60B4 



8409 
B40A 



B40C 
B40D 
B40E 



B410 
B411 
6412 
8413 
8414 
8415 
8416 



8417:18 
8418:69 30 
841A:8D5FB4 
B41D:2000BF 
8420 :C8 
8421:48 84 
8423:90 03=6428 
8425:800964 
8428:AD4DB4 
8428: 80 4F 64 
842E:8D57B4 
8431: 20 00 6F 
6434 :CA 
6435:4Ee4 
8437:90 03 =B43C 
B439:8O0A84 ■ 
B43C:20008F 
B43F:CC 
6440:56 84 
8442:9003=8447 
6444:800684 
6447:60 



B448 
6449 
B446 
6440 

844E 
644F 
6450 
6452 
6454 



03 

5864 
00 67 



00 8A 
0010 



6456:01 
8457:00 

6458:07 

6459:44 2E 55 53 
6450:41 2E 
645F:31 



8460:200079 
6463: 20 64 7E 
6466:120 0364 
6469: 20 FC 64 
6460:200865 
B46F:2014e5 
6472: 20 00 6F 
6475 :CC 
6476:4065 

6478:A06F8A 
8476:85 6F 
e470:A0EA8A 



17 
18 
19 

20 TR ADR 

21 ORG $8400 
22 

23 * Uk pkmi i ]MPs an rtfd innmpgm 
24 

25 JMPGetJict LkAeime? 

26 JMP Saver sm-a-pm 

27 JMP Restore hsion-a-^m 
28 

29 OoopS HEX 00 

30 OoopSl HEX 00 

31 OoopS2 HEX 00 

32 Ramnitl HEX 00 

33 Raninit2 HEX 00 

34 Raninit3 HEX 00 

35 Rainnit4 HEX 00 

36 RamnitS HEX 00 

37 Nut HEX 00 

38 Nutz HEX 00 

39 Nutzl HEX 00 

40 Nutz2 HEX 00 

41 Nutz3 HEX 00 

42 Nutz4 HEX 00 
43 

44 Get_Dict CLC 

45 ADC #$30 

46 STA Oictjum 

47 JSR ML I Open the requested diet. 

48 DF8 Open 

49 DA DJPEN 

50 BCC GoOn 

51 STA OoopS 

52 GoOn LDA D_DPEN+5 

53 STA D_SEA0+1 

54 STA D_CL0SE+1 

55 JSR ML I Read it Ipretty (Mous) 

56 OFB Read 

57 DA D_REAO 

58 BCC GoOnl 

59 STA OoopSl 

60 GoOnl JSR ML I Gmytiattlasdoes. 

61 DF6 Close 

62 DA DJILOSE 

63 6CC Gone 

64 STA OoopS2 

65 Gone RTS BycMtoSaMle 
66 

67 OJ)PEN HEX 03 Pm lists for Get-Diet 

68 DA Diclen 

69 DA $6700 

70 OS 1 
71 

72 0_SEAD HEX 04 

73 OS 1 

74 DA $8A00 OcLbiifr 

75 DA $1000 rtquesltdlen. 

76 OS 2 
77 

78DJ;L0SE HEX 01 

79 OS 1 



81 
82 

83 
84 
85 
86 
87 
88 
89 
90 
91 
92 
93 
94 
95 
96 
97 
98 
99 



Diclen 0F6 Dict_iiuni-Diclen 
ASC 'O.USA.' 



Oictjiuni ASC '1' 



Restore JSR SaveJW 
JSR $7E64 
JSR Restorel 
JSR Restore2 
JSR Restore3 
JSR Restore4 
JSRHLI 
OFB Close 
OA HXLOSE 

L0A$8A6F 

STA$BF 

LDA$8AEA 



dmiestolX3or4 



mitae 



8480:85 EA 
8482:A0 78 8A 
8485:85 78 
8487:AD7F8A 
848A:85 7F 
B48C:A0 7C8A 
648F:85 7C 
6491:A0CE8A 
8494:85 CE 
B496:A08C8A 
6499:85 80 
B496:ADCF8A 
849E:85CF 
64A0:AO7A8A 
84A3:85 7A 

84A5:A5BF 
64A7:C901 
84A9:F00F=84BA 
84AB:C902 
84AD:F0 08=B48A 
B4AF:C9 03 
B4B1:F0 07=846A 
6483:09 04 
84B5:F0 03=B4BA 
8487:400008 

B4BA:A5 7B 
8480:09 00 
B4BE:F00F=B4CF 
6400:09 01 
84C2:F0 0B 
84C4:C9 02 
B4O6:F007 
6408:09 03 
B4CA:F0 03=B4CF 
84CC:4O0008 



=B4CF 
=84CF 



B4CF:200F79 
6402:60 



8403: 20 00 BF 

6406:08 

8407:5066 

8409:90 03 =64DE 

6406:800064 

840E:A06186 

B4E1:802185 

64E4:802965 

e4E7:8D3185 

64EA:8039B5 

64E0:8Q4165 

e4F0:20006F 

B4F3:CA 

64F4:2065 

B4F6:9003=64F6 

B4F8:8O0D84 

64FB:60 



B4FC:20006F 

84FF:CA 

6500:2865 

6502:9003=8507 

6504:80 0EB4 

6507:60 



8508:2000 6F 

850e:CA 

6500:3065 

650E:9003=8513 

6510:80 0F 84 

6513:60 



6514: 20 00 6F 

6517:CA 

6518:3865 

851A:9003=851F 

6510:801084 

B51F:60 



100! 

101 

102 

103 . 

104 , 
105 
106 
107 
108 
109 
110 
111 
112 
113 
114 
115 
116 
117 
118 
119 
120 
121 
122 
123 
124 
125 
126 

127 Rl 
128 
129 
130 
131 
132 
133 
134 
135 
136 
137 

138 R2 
139 
140 

141 Restorel 

142 

143 

144 

145 

146 

147 R3 

148 

149 

150 

151 

M 
153 
154 
155 
156 
157 

158 R4 
159 

160 Restore2 
161 
162 
163 
164 
165 

166 R5 
167 

168 Restore3 
169 
170 
171 
172 
173 

174 R6 
175 

176 Restore4 
177 
178 
179 



STA $EA 
LDA $8A7B 
STA $78 
LDA $8A7F 
STA $7F 
LDA $8A70 
STA $7C 
LDA $8A0E 
STA $CE 
LDA $8A8C 
STA $60 
LDA $8A0F 
STA $CF 
LOA $8A7A 
STA $7A 

LDA $6F 
CMP #$01 
6EQR1 
CMP #$02 
BEQRl 
CMP #$03 
BEQRl 
CMP #$04 
eEQRl 
JMP H0800 

LOA $78 
CMP #$00 
8E0R2 
CMP #$01 
BE0R2 
CMP #$02 
BEQR2 
CMP #$03 
BE0R2 
JMP H0800 

JSR Rest_D0 
RTS 



JSR ML I Openhsaxejile 

0F8 Open 

DA S_PPEN Use h SAVE OPEN 
parm 
B0CR3 
STA Ramnitl 
LDA SJ)PEN+5 
STA RJEAOl+1 
STARJIEAD2+1 
STARJ1EA03+1 
STA R_BEAD4+1 
STAIlXLOSE+l , 
JSRMLI Rtadmohiato$m 
DPe Read 
DA RJEADl 
eCCR4 
STA Ramnita 
RTS 



8520 
8521 
6522 
8524 
6526 



04 
00 

00 6E 
00 00 



JSRMLI 
OFB Read 
DA RJ!EA02 
BC0R5 
STA Raimiit3 
RTS 



JSR MLI 
OFB Read 
OA RJIEA03 
BCCR6 
STA Raiiinit4 
RTS 



Ittadmb^toim 



Read mbytes to $m 



181 

182 R7 
183 



JSRMLI Readmbylestom 

DFB Read coiitmpg.Owlm 

DA R_BEAD4 

BCCR7 

STA RannitS 

RTS 



6528:04 
6529:00 
652A:00 54 
6520:0002 
B52E:0000 



04 



8531 
8532 
8534 
8536 

8538 
6539 
653A 
6530 
653E 



00 50 
0002 



00 8A 
0002 



icommrwnlm 



6540:01 
8541:00 



8542:2000 79 
8545:A90A 
8547:85 80 
6549:A9 00 
8548:85 81 
8540:200008 
6550:20 36 40 
8553 : 09 CE 03 05 

8557:02 04 A0 02 
8558 : CO 01 CE 08 
855F:A0O4O9D3 
6563:08 A0A8 00 
6567:D2 0FC4CF 
6566:03 A9A0 01 
856F:CEO4A0C8 
6573:09 04 A0 01 
B577:A0CBO5D9 
6576:00 

e57C:2006 5O 

657F:A90A 

6581:8580 

6583:A900 

6585:8581 

6587:200008 

B58A:203640 

8580:07 CI CD 05 

6591 :A0 03 CI 06 

6595:C9CEO7A0 

6599:D4CFA0D3 

6590:AEC7 01C0 

B5A1:C5A0O6C9 

65A5:CCC5 

65A7:00 

65A8:2000eF 

65A6:08 

B5AC:50e6 

65AE:900E=85BE 

6560:801164 

8563: 20 00 6F 

8586:00 

8587:5086 

6589:90 ED =B5A8 

6566:8012 84 

656E:A06166 

6501:802185 

6504:802965 

85C7:8031B5 

B5CA:8D6366 

65C0:806666 

6500:20 00 BF 
6503:08 



184 R_READ1 

185 

186 

187 

188 

189 

190 R_READ2 

191 

192 

193 

194 

195 

196 RJEA03 

197 

198 

199 

200 

201 

202 RJEAD4 

203 

204 

205 

206 

207 

208 R_CL0SE 

209 

210 

211 * 

212 

213 Saver 

214 

215 

216 

217 

218 

219 

220 - 



221 
222 
223 
224 
225 
226 
227 
228 
229 
230 



231 

232 

233 TryAgin 

234 

235 

236 

237 

238 

239 

240 

241 

242 

243 Get I ton 

244 

245 

246 

247 

248 

249 

250 

251 



HEX 04 
OS 1 

DA $6E00 f 
DA $0000 
OS 2 

HEX 04 

OS 1 

DA $5400 

DA $0200 

OS 2 

HEX 04 
DS 1 
DA $5000 
OA $0200 
DS 2 

HEX 04 
OS 1 
DA $8A00 
OA $0200 
DS 2 

HEX 01 
DS 1 



JSR Save_D0 Save a game 

LDA #$0A 
STA $80 
LDA #$00 
STA $81 
JSR H080C 
JSR Prntjnes 
ASC "INSERT BLANK DISK 
(PROOOS)ANOHITAKEY" 



HEX 00 

JSR Get Jey 
LOA#$0A 
STA $80 
IDA #$00 
STA $81 
JSRH080C 
JSR Prntjnes 

ASC "GAME SAVING TO S.GAHE 
FILE" 



OpenAesmpe 



HEX 00 

JSRMLI 
OFB Open 
OA SJ)PEN 
BCC Get I ton 
STA Nut 
JSRMLI 
OFB Create 
OA Sja^EATE 
BCC TryAgin 
STA Nutz 
LDA S_DPENt5 
STA R_READ1+1 
STA RJ(EAD2+1 
STA RJIEA03+1 
STA SJRITE+l 
STA S_CL0SE+1 



JSRMLI Write miyiesfim mo 
DFB Write 



jHeMi'texig 

Now try to open it 
ferr, sm won't work 



#. .»fdOT;..Pirt«>«Kcim»g» # 



Ml 



B5D4: 
B5D6: 
B5D8: 

B5DB 
B5DE 
B5DF 
B5E1 
B5E3 

B5E6: 
B5E9: 
B5EA: 
B5EC: 
B5EE: 

B5F1: 
B5F4: 
B5F5: 
B5F7: 
B5F9: 

B5FC 
B5FF 



B602 



B606 
B608 
B60A 



B610 

B614: 
B618: 
B61C: 
B620: 
B624: 
B628: 
B62C: 
B630: 
B634: 
B635: 

B636 
B639 
B63C 
B63F 



20 B5 

9003=B5DB 

8D13B4 

2000BF 

CB 

28 B5 

90 03 =B5E6 

8D 14 B4 

20006F 

CB 

30 B5 

9003=B5F1 

8D15B4 

20 00BF 

CB 

62 66 

9003=B5FC 

8D16B4 

2000BF 
CC 

6AB6 
A9 0A 
85 80 
A900 
85 81 
200C08 
2036 40 
D2C5ADC9 

CE D3 05 D2 

D4A0D3C3^ 

D2C1C2C2 

CCC5A0C4 

C9D3CBA0 

01 OE 04 A0 

C8O9D4A0 

01 A0 OB 05 

D9 



20 06 50 
20 0008 
200F79 
60 



252 
253 
254 
255 
256 
257 
258 
259 
260 
261 
262 
263 
264 
265 
266 
267 
268 
269 
270 
271 
272 
273 
274 
275 
276 
277 
278 
279 
280 
281 
282 
283 



SI 



S2 



S3 



S4 



DA RJiEADl 
BCCSl 
STA Nutzl 

JSR ML I Write mbp from $5m 

DFB Write 

DA R_READ2 

B00S2 

STA Nutz2 

JSR ML I Write m bytes frm $5000 

DFB Write 

DA RJEAD3 

B0CS3 

STA Nutz3 

JSR ML! Write $100 bytes from mo 

DFB Write 

DA SJRITE 

BCCS4 

STA Nutz4 

JSR ML I 
DFB Close 
DA S_CLOSE 
LDA #$0A 
STA $80 
LDA #$00 
STA $81 
JSR H080C 
JSR Prntjnes 
ASC "RE-INSERT SCRABBLE 
DISK AND HIT A KEY" 



B641 
B645 
B649 
B64D 



B650: 
B651: 
B653: 
B654: 
B655: 
B657; 
B658: 
B65A: 

B650: 
B65D: 
B65F: 
B661: 

B662 
B663 
B664 
B666 
B668 

B66A: 
B66B: 



284 
285 
286 
287 
288 
289 
290 
291 
292 



0F 

2F 53 43 52 
41 42 42 40 
2F 53 2E 47 
414D45 

=B64F293 

294 
07 295 
40 B6 296 
03 297 
06 298 
00 10 299 
01 300 
00 00 301 
0000 302 

303 

03 304 
40 B6 305 
00 B7 306 
00 307 

308 

04 309 
00 310 
0000 311 



Savlen 



S5 



HEX 00 

JSR GetJey 
JSR H080O 
JSR Rest J)0 
RTS 

DFB S5-Savlen 

ASO 7SCRABBL/S.GAME' 



EQU *-l 



SJ;REATE HEX 07 

DA Savlen 
HEX 03 
HEX 06 
DA 

HEX 01 
DS 2 
DS 2 



Access 

Ftypefbm.} 

Aia. data (addr.) 

Store, type 

Dale 

Tme 



S_DPEN 



HEX 03 
DA Savlen 
DA $B700 
DS 1 



SJRITE HEX 04 
DS 1 
DA $0000 
DA $0200 
DS 2 



00 02 312 

0000 313 
314 

01 315 S_CLOSE HEX 01 
00 316 DS 1 



7E44: 
7E46; 
7E48; 
7E4A: 
7E40: 
7E4E: 
7E50: 
7E52: 
7E54: 
7E56; 
7E58: 
7E5A: 
7E5B: 
7E5D: 
7E5F: 
7E61: 
7E62: 

7E64: 
7E66: 
7E68: 
7E6B: 
7E6C: 
7E6E: 
7E70: 
7E73: 



A900 
85 00 
85 02 
A9B4 
8503 
A9 20 
85 01 
A2 04 
A000 
B100 
9102 
88 

D0F9=7E56 
E6 01 
E6 03 
CA 
D0F2=7E56 

A9 00 

A210 

9D5FBF 

OA 

D0FA=7E68 

A9 01 

8D6FBF 

60 



6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 



ORG 



LDA 
STA 
STA 
LDA 
STA 
LDA 
STA 
LDX 
LDY 
LDA 
STA 
DEY 
BNE 
INC 
INC 
DEX 
BNE 



CLEARMAP LDA 
LDX 



LI 



L2 



STA 
DEX 
BNE 
LDA 
STA 
RTS 



$7E44 

#$00 DOSrelocater 

$00 

$02 

#$B4 

$03 

#$20 

$01 

#$04 

#$00 

($00), Y 

($02), Y 

LI 

$01 

$03 

LI 

#$00 Ktmap dearing routine 

#$10 

$BF5F,X 

L2 

#$01 

$BF6F 



Hexdump of Scrabble-ProDOS interface 



1 *SmMkPToDOSrdocaUcode(ad 

2 * Bitmap dearing routine 

3 * by James A. Mge 
4 

5 TR ADR 



2000: 
2008: 
2010: 
2018: 
2020: 
2028: 
2030: 
2038: 
2040: 
2048: 
2050: 
2058: 
2060: 
2068: 
2070: 
2078: 
2080: 
2088: 
2090: 
2098: 
20A0: 
20A8: 
20B0: 
20B8: 
20C0: 
20C8: 
20D0: 
20D8: 
20E0: 
20E8: 
20F0: 
20F8: 
2100: 
2108: 
2110: 
2118: 
2120: 
2128: 
2130: 
2138: 
2140: 
2148: 
2150: 
2158: 
2160: 
2168: 
2170: 
2178: 
2180: 
2188: 
2190: 
2198: 
21A0: 
21A8: 



4C17 
B4 00 
00 00 
69 30 
C8 48 
AD4D 
84 20 
03 8D 
56 84 
03 58 

00 8A 
07 44 
20 0C 

84 20 
14 85 
AD8F 

85 EA 
7F8A 
7CAD 
8A85 
AD7A 

01 F0 

03 F0 
00 08 
C9 01 
C9 03 
0F79 

86 90 
86 8D 
31 85 
20 00 
8D0D 
28 85 
20 00 
8D0F 
38 85 

04 00 
04 00 
04 00 
04 00 
0100 
80 A9 
20 36 
D4A0 
C4C9 
CFC4 
C4A0 
CBC5 
0A85 
0C08 
C5A0 
A0D4 
CDC5 
20 00 



84 4C 
00 00 
00 00 
8D5F 
84 90 
84 8D 
00 8F 
0A84 
90 03 

84 00 
00 ID 
2E 55 

79 20 
FC84 

20 00 
8A85 
AD 78 

85 7F 
CE8A 
8CAD 
8A85 
0FC9 
07 C9 
A5 78 
F0 0B 
F0 03 
60 20 
03 8D 

21 85 
8D39 
8FCA 
84 60 
90 03 
8FCA 
84 60 
90 03 
00 6E 
00 54 
00 50 
00 8A 
20 0C 
00 85 
40 C9 
C2CC 
D3C8 
CFD3 
C8C9 
D9 00 

80 A9 
20 36 
D3C1 
CFA0 
A0C6 
BFC8 



42 85 
00 00 
00 00 

84 20 

03 8D 
4FB4 
CA4E 
20 00 
8D08 
87 00 
00 00 
53 41 
64 7E 
20 08 
8FCC 
8FAD 
8A85 
AD7C 

85 CE 
CF8A 
7AA5 
02 F0 

04 F0 
C9 00 
C9 02 
4C00 
00 8F 
0C84 
8D29 
85 8D 
20 85 
20 00 
8D0E 
30 85 
20 00 
8D 10 
00 0D 
00 02 
00 02 
00 02 
79 A9 
81 20 
CED3 
CICE 
A0A8 
A9A0 
D4A0 
20 06 
00 85 
40 C7 
D6C9 
D3AE 
C9CC 
5CB6 



4C60 
00 00 
00 18 

00 8F 
09 84 
8D57 
84 90 
BFCC 

84 60 
04 00 

01 00 
2E31 
20 D3 

85 20 

40 85 
EA8A 
78 AD 
8A85 
AD8C 
85 CF 
8FC9 
0BC9 
03 4C 
F0 0F 
F0 07 
08 20 
C8 5C 
AD 61 
85 8D 

41 85 
90 03 
BFCA 
84 60 
90 03 
BFCA 
84 60 
00 00 
00 00 
00 00 
00 00 
0A85 
0C08 
C5D2 
CBA0 
D0D2 
CICE 
CI A0 
5CA9 
81 20 
CI CD 
CEC7 
C7C1 
.C5 00 
90 0E 



$5F17 
$9527 
$1D1B 
$78CF 
$CF05 
$2348 
$591F 
$0598 
$A88E 
$06CE 
$AD24 
$828A 
$6DEB 
$8D94 
$8835 
$AE2F 
$850E 
$9338 
$FB6D 
$64A9 
$F2E6 
$1517 
$796C 
$9D5A 
$94E3 
$04F4 
$674C 
$15DA 
$8251 
$7A67 
$031C 
$2597 
$13D8 
$9253 
$E439 
$72A5 
$4832 
$8535 
$EFA8 
$5FAC 
$0648 
$F8C1 
$E95D 
$4004 
$0081 
$258F 
$AE4A 
$9391 
$A014 
$0F3O 
$0020 
$8920 
$9C70 
$815F 



21B0: 
2188: 
21C0: 
21C8: 
2100: 
2108: 
21E0: 
21E8: 
21F0: 
21F8: 
2200: 
2208: 
2210: 
2218: 
2220: 
2228: 
2230: 
2238: 
2240: 
2248: 
2250: 
2258: 
2260: 
2268: 



8D11 
86 90 

86 80 
31 85 
20 00 
80 13 
85 90 
8FC8 
B4 20 

03 80 
6A86 
85 81 
02 C5 

04 A0 
CCC5 
CICE 
CI A0 
5C20 
0F2F 
4C2F 
07 40 
00 00 

87 00 
00 00 



84 20 
ED 80 
21 85 
80 63 
BFCB 
84 20 
03 80 
30 85 
00 8F 
16 84 
A9 0A 
20 0C 
A0C9 

03 C3 
A0C4 
C4A0 
C8C5 
0C08 
53 43 
53 2E 
86 C3 

00 00 

04 00 

01 00 



00 8F 
12 84 
80 29 
86 8D 
20 85 
00 BF 
14 84 
90 03 
C8 62 
20 00 
85 80 

08 20 
CE03 

02 CI 
C9 03 
C8C9 

09 00 
20 0F 
52 41 
47 41 
06 00 

03 40 
00 00 



C0 50 
AD 61 

85 80 
68 86 
90 03 
CB28 
20 00 
80 15 

86 90 
BFCC 
A9 00 
36 40 
C5 02 
C2C2 
C8A0 
04 A0 
20 06 
79 60 
42 42 
40 45 
10 01 
B6 00 
00 02 



$3179 
$2789 
$90F2 
$E058 
$3168 
$EA98 
$18C2 
$738E 
$3483 
$4698 
$78C0 
$0748 
$EA45 
$1316 
$4280 
$93.50 
$8787 
$54DF 
$21E8 
$18E1 
$A163 
$5808 
$209C 
$42E0 



Hex dump of ProDOS relocate 

7E44 : A9 00 85 00 
7E48 : 85 02 A9 84 85 03 A9 20 
7E50: 85 01 A2 04 A0 00 81 00 
7E58: 91 02 88 00 F9 E6 01 E6 
7E60 : 03 CA 00 F2 A9 00 A2 10 
7E68 : 9D 5F BF CA 00 FA A9 01 
7E70: 8O6FBF60 



code 



$E086 
$8962 
$05A8 
$31C0 
$4336 
$4CB0 
$F643 



HeUo program to nm Scrabble with the /RAM disk 

100 TEXT : HOME : HGR 

110 PRINT CHR$ (4) "PREFIXVSCRABBL" 

115 PRINT CHR$ (4) "BLOAD'SCRABTIT" 

120 PRINT : VTAB22: PRINTTAB(8) "'ALF'A'MO, 'THERE,' 

FELLA" 
130 PRINT CHR$ (4) "BLOAD'D.USA. 1 ,A$4000" 
140 PRINT CHR$ (4) "BSAVEVRAM/D.USA.1,A$4000,L$17AE" 
150 PRINT CHR$ (4) "BLOAD'D.USA.2,A$4000" 
160 PRINT CHR$ (4) "BSAVEVRAM/D.USA.2,A$4000,L$1614" 
170 PRINT CHR$ (4) "BLOAD'D.USA.3,A$4000" 
180 PRINT CHR$ (4) "BSAVEVRAM/D.USA,3,A$4000,L$18DB" 
190 PRINT CHR$ (4) "BLOAD'D.USA.4,A$4000" 
200 PRINT CHR$ (4) "BSAVE7RAM/D.USA,4,A$4000,L$18A1" 
210PRINTCHR$(4) "PREFIXVRAM" 
220 TEXT: HOME : PRINT 
230 VTAB 12: PRINT TAB( 4) "GET' READY .' HERE' COMES' 

SCRABBLE ' " 
240 PR I NT CHR$ (4) "BRUN'/SCRABBL/SCRABBLE" 



100 - $0930 
110 - $4806 
115 - $10BC 
120 - $3723 
130 - $FCC5 
140 - $4E5F 



Checksmns 

150 - $E54B 
160 - $4DCD 
170 - $5432 
180 - $9B19 
190 - $5F4D 
200 - $D7C6 



210 - $1FC6 
220 - $8C1B 
230 - $7AC1 
240 - $5F15 



Softkey for.. 



Scruples 

Leisure Genius 



This game will be easy to de-protect if you've got an 
Apple Ilgs with the 01 revision ROMs, otherwise, you're 
on your own. The softkey I wrote for Scrabble may give 
you some guidance for cracking Scruples on a non-IIgs. 

There are four files needed from the Scruples disk: 

A 3 HELLO 

B 34 LOADER ; A$2000, L$200D 
B 87 SCRUPLES; A$1FA7, L$55E4 
A 2 RUN 

Capturing these files involves using the "Visit 
Monitor" Ugs desk accessory. 

I 1 I Boot Scruples. When you see the message, "A P P 
LESCRUPLE S", hit CS Base and get into "Visit 
Monitor". 



3i 
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[2"] Convert a CALL token to a STOP token. 
932:B3 

I 3 I Enter a BY and hit return 3 times . That takes you back 
to the game. 

I 4 I When the game STOPs, get into the monitor through 
"Visit Monitor" and move the HELLO program to a safe 
location. 

5000<800.A00M 

I 5 [ Boot a HELLOless slave disk with the command 
"C600G". Then, get into the monitor using "CALL 
-15 1 " and move the HELLO program back down to $800. 

800<5000.5200M 
AF:78 9 

I 6 I Save the Hello program and the binary Loader. 

SAVE HELLO.THERE 

BSAVE LOADER, A$2000, L$200D 

I 7 i Boot Scruples again. When you see the message, "A 
PPL E SCRUPLE S", hit c5 Sesc and get into "Visit 
Monitor". 

I 8 I Now convert the CALL token to a REM token and 
edit the "RUN RUN" command. 

932:B2 

7F = F 

953:"BLOAD SCRUPLES,A$1FA7" 

968:22 3A B3 

I 9 I Press BY and hit return 3 times. That takes you back 
to the game. When the disk drive stops the SECOND time. 
Scruples should be loaded. 

I 10| Boot the slave disk again. 

BSAVE SCRUPLES, A$1FA7, L$55E4 

There are 2 ways to get the "RUN" file, die hard 
way and the easy way. The hard way is to use the technique 
used above. The easy way is to just enter the program. 

10 TEXT : HOME 

20 PRINT CHR$(4)"BRUN SCRUPLES,A$1FA7" 

SAVE RUN 

And that's all there is to it! 



New routines for Super lOB 

These routines won't make Super lOB any smarter 
or work any faster, but they make working with it a little 
more convenient. 

Line 65 will save the controller as a text file. While 
I'm trying to develop a controller, I save the Super lOB 
as an Applesoft file, and it usually takes 17 or 18 sectors 
of disk space. When the controller finally works, I "RUN 
65", save it as a text file, and it takes (on average) only 
3 to 5 sectors of disk space. 

The second routine automates the chore of making a 
lot of data statements for large disk patches. 

It requires that the disk patch be in memory. I usually 
read the sector that I've patched in with the Copy H Plus 
sector editor, get into the monitor through the Ilgs "Visit 
Monitor" desk accessory, and move the sector buffer 
somewhere safe. After I get out of the sector editor, I load 
in Super lOB, move the sector data into main memory, 
and "RUN 700". 

There are seven variables that need to be set. 

NL - Number of Lines of DATA statements 

VL - number of Values on a Line 

FD - First Data stmnt line number 

AD - Address where the patch is located. The equation 
format in line 710 will convert a hex address to decimal 
if the Os are replaced with the corresponding digit from 
a 4 digit hex address. For example, if the patch code is 
located at $234F, the equation would be "AD = 4096 
* 2 + 256 * 3 + 16 * 4 + 15". 

TR - Track number of sector to patch 

S - Sector niunber to be patched 

BA - Byte Address (within the sector) that patch starte 
at 

You need to supply the appropriate values for NL and 

com&nstns ■ '^ ■ - . . .. .„ .... , 



VL. For example, if you have 25 values to put in data 
statements and you want 4 values on a line, VL will equal 
4 and NL will equal 7. When you copy over the data 
statements just don't copy over the last three sets of values 
on the last Une. 

This routine will print the data statements on the 
screen. You must copy over them to actually add them 
into the Super lOB. A line could be added to open a text 
file for writing. Then the statements could be EXECed 
into the program. 

65 D$ = CHR$ (4) : I NPUT "SAVE F I LENAME? " ; F$ : POKE 33 , 33 ; 
PRINT D$"0PEN "F$: PRINT D$"WRITE"F$: LIST 
1000,9999: PRINT D$"CL0SE": TEXT : END 

700 REM MAKE DATA STMTS 

705 NL = : VL = 4 

710 FD = 2000 : AD = 4096 *0 + 256 *0+ 16*0 + 

715TR = : S = : BA = 

720 FOR I = 1 TO NL : PRINT FD + ( I - 1) * 10 "DATA" ; 

730 FOR J = 1 TO VL : PRINT TR" , "S" , "BA" , " PEEK (AD) 
CHR$(44-(VL = J) * 12); 

735 BA = BA + 1 : AD = AD + 1 

750 NEXT : PRINT : NEXT : END 



B. Dudley Brett 



Here are softkeys for two old clinkers. Magic Spells 
and Moptown of Special Delivery Software. These are 
1981 vintage programs, probably not found in too many 
people's libraries. 

However, the method I used to softkey may have 
application to some other programs. The method can be 
used with a DOS 3.3 disk with a catalog, but having a 
rewritten DOS so that the method of using a captured 
RWTS and swap controller or DeMuffin Plus will not 
work. 

I caimot claim to have originated the approach; 
Wmiam Clarke in COMPUTIST #30 fiimished the. 
concept. I have made some changes in his method so that 
use of an Apple He is not completely necessary, and have 
tried to explain how to remove flie frustration of necessary 
monitor move operations. ITie latter especially gave me 
some problems initially. I thought that my computer, an 
Apple He clone, was just not working properly. However, 
using monitor moves with two other conq>uters, an Apple 
m- and a true Apple He, indicated the problem was 
general. 

Though I can attest to die validity of my approach to 
deprotecting programs such as these, I must admit to the 
fact that the method is time consuming, fraught with 
frustration (delightful for a masochist!) and to be attenopted 
only as a last resort. There is a bit of instructional value 
in my acconq)anying article, though. 



Softkey for.. 



Magic Spells 
Moptown 

Special Delivery Software 



Recently I obtained these ancient releases of 1981 and 
decided to try to remove the copy-protection ft'om them. 
Whereas both could be bit-copied, neither could be easily 
copied. Altered marks, changing from sector to sector, 
altered checksums, etc. suggested that the easy way of just 
fixing the read nuirks would be a tedious job. 

I next tried to capture the RWTS, but quickly found 
that it was an extensively rewritten DOS 3.3 RWTS, with 
different entry point addresses. In short, I was unable to 
use a swap controller with this RWTS, as it simply was 
not compatible with the rest of DOS 3.3. Perhaps another 
approach was requh-ed! Formnately for the cause of disk 
deprotection, (though, considering the extensive amount 
of fiddling required, perhaps not so elegant), I remembered 
an article by William Clarke (Deprotecting Millionaire, 
COMPUTIST #30, pp. 12-15). Clarke's approach was to 
use auxilliary memory to trap images of both the copy- 
protected DOS md normal DOS, shuffling each into the 
correct place ($9600 to $BFFF) when required. Thus one 
could read programs from the protected disk with its own 
DOS, and dien write the same program to a normal disk. 

I prompdy decided to try Clarke's method, not 
realizing the amount of time that would be required, nor 
the fiiistration ahead as something would not work as 
expected. After this experience, I have come up with a 
workable method, with only a few frustrations left, but 



still requiring more than the usual time of a normal 
COMPUTIST softkey. This, therefore, is an approach to 
be tried with some trepidation, and only as a last resort. 
First let me relate some of the frustrations 
encountered. William Clarke suggested storing both the 
protected DOS and normal DOS in auxilliary memory, 
then making a memory move through the control-Y vector 
to a move routine in page $03. Unfortunately, I found that 
sometimes it would work and sometimes my Apple He 
would just "hang". If I pressed Sreset to stop the 
nonsense, I usually had a devil of a time restoring things, 
so that I could complete the operation. I was continually 
turning the computer on and off, and getting more 
frustrated. But, I then realized that both "DOS's" did not 
have to be stored in auxiliary memory, as any file on the 
protected disk could simply be loaded low in memory, 
allowing the 2 DOS routines to reside from $4000 to 
$93FF without mishap. The computer still would "hang", 
but not beyond recovery. With this major source of 
fiiistration out of the way, I could and did deprotect the 
two disks. Here now is the method. 

Strategy 

The entire transfer of all files from the protected disk 
to a normal DOS 3.3 disk (preferably with a fast DOS) 
involves a number of steps. These are: 

• Initiallize a DOS 3.3 disk (for each of the 2 programs). 

• Capture the DOS ft'om one of the disks (I used MAGIC 
SPELLS) and BSAVE it on a normal disk. 

• Transfer Applesoft files to one of the initiallized disks 
(This requires both DOS files). 

• Using SDS.DOS (die captured DOS), BLOAD each 
binary file into memory, and find address and length (a 
memory search is needed as the normal DOS 3.3 pointers 
won't work). 

• Transfer binary files to an initiallized disk (using the 
addresses and lengths previously found). 

• Using a special Applesoft transfer program and binary 
memory move routine, transfer all text files to the 
initiallized disk. 

• Make one small edit to the HELLO program to remove 
the reset trap. 

Trap Magic Spell DOS 

To capture the DOS from Magic Spells or Moptown 
a method of bypassing the reset trap used in both these 
programs must be found. If one has some method of 
resetting into the monitor, the procedure is simple. If not. 
Ken Greenlaw's (COMPUTIST #16) method requiring an 
Apple He and extended memory can be used. This follows: 

m Initiallize. with a fast DOS 3.3, one disk for each 
program which is being deprotected. 

[T] Insert the disk containing your COMPUTIST 
cracking tools. 



BLOAD XFER.BOOT 
PR#3 



Greenlaw's routine 



I 3 [ Put the original disk in drive #1. 



CALL768 
Breset 



after the drive stops 



I 4 I Put your cracking disk in drive 1 . 



BLOAD RESTORE 

CALL-151 

3F8:4C 00 03 

4000<9600.BFFFeY 

BSAVE SDS.DOS, A$4000, L$2A00 



memory move routine 

set control-Y vector 
Move mem fi-om aux to main 



Save the Applesoft Files 

To transfer all Applesoft files from the protected disk, 
the technique is to move the SDS.DOS in place of normal 
DOS 3.3, load a file, replace normal DOS and write to 
the initialized disk. The process is repeated for each file. 
I did experience one minor problem making memory 
moves in the monitor while trying to exchange the 
operating DOS. Whenever I first attempted a move, such 
as 9600<4000.69FFM, my computer would hang. I found 
that pressing reset and repeating the move was successfid. 
I am not sure if this is just a qiurk of my computer, and 
will include this double move in my instructions just in 
case. 

I 1 i Put in your cracking disk. • 



^i>ata"ffihdi^iriii^» 



BLOAD SDS.DOS, A$4000 

CALL-lSl ^ 

6A00<9600.BFFFM move DOS 3.3 copy into low memory 

I 2 I Set things up to read the protected disk. 

move SDS.DOS up into command space 
do this only if computer hangs 



9600<4000.69FFM 

8 reset 

CALL-lSl 

9600<4000.69FFM 

8C 



repeat the move 
get back to BASIC 



I 3 I Place original disk in drive 1 . 
LOAD programiDl 



CALL-lSl 
9600<6A00.93FFM 
6 reset 
CALL-lSl 
9600<6A00.93FFH 



Either CATALOG first or consult the list 
included in this article 

move DOS 3.3 wp into command space 
if cotnputer hangs 



repeated move 

I 4 I Place initialized disk in drive (preferably drive 2). 

BC 

SAVE program,D2 use the same name as in step 3 

Repeat steps 2-4 for each Applesoft file. I would 
suggest write protecting the original disk so as to avoid 
tragic mistakes. 

The Applesoft files to save are: 

Magic Spells 

HELLO 

MENU2 
MSHR4 
WRITERS 

Moptown 
HELLO 

MENU 

MAKE MY TWIN 
WHO'S DIFFERENT? 
WHAT'S THE SAME? 
WHO COMES NEXT? 
MOPTOWN PARADE 
WHO'S NEXT DOOR? 
SECRET PAL 
CHANGE ME 
CLUBHOUSE 
MOPTOWN MAP 
MOPTOWN HOTEL 

Finding the Binary Files 

In order to transfer protected binary files to your 
initialized disk, their beginning address and length must 
be known prior to any BSAVE. If the SDS.DOS were 
more similar to DOS 3.3, this would be an easy operation, 
as one could simply BLOAD the file, and read locations 
$AA72.AA73 for the address and $AA60.AA61 for 
length. These pointers, however, could not be found in 
SDS.DOS, and thus a more involved technique is required. 
After SDS.DOS has been moved into operation, memory 
on page $03 and from $800 to $9500 must be cleared to 
zeros before any file is BLOADed. Then a scan through 
memory is made using 8 S to stop the scroll of memory 
so as to read file start and end addresses. This process 
can be shown by a simple example. 

I 1 I Boot DOS 3 . 3 and put your cracking disk in drive 1 . 

BLOAD SDS.DOS, A$4000 

CALL-lSl 

9600<4000.69FFM 

6 reset 

CALL-lSl 

9600<4000.69FFM 

CATALOG 



move SDS.DOS into control 

if computer hangs only! 

reenter monitor after reset 

repeat move if necessary 

write down binary file names 



I 2 [ Clear memory. 



300:00 N 301<300.3C0M 
800:00 N 80K800.9500M 
BLOAD binary program 
800.9500 

es 



write OO's in page 3 
write OO's to rest of RAM 



start a scroll down memory lane 
when OO's change to file start 

Start the scroll again, after writing down file start 
address, stopping it when OO's reappear to find file end. 
Repeat step 2 to locate all other binary files. 



memory, such as $11. If a binary file is BLOADed, instead 
ofBRUN, it may contain leading or trailing $00s. RDEXed 
What if the binary file cannot be found from $800 to 
$9500? First search page $03 (300LL etc.). Some files 
are also BLOADed into Low Res graphics ($400.7FF). 
If the monitor screen fills with garbage, you know that 
its address is A$400 and its length is $400 bytes. 
Fortunately, it doesn't matter too much where you 
eventually BSAVE this picture file, as the controlling 
Applesoft program states the BLOAD address. 

BSAVEing the Binary Files 

The binary files may be saved using a sinular 
technique to that employed to capture Applesoft files. An 
example follows. 

I 1 I Put in your cracking disk. 

BLOAD SDS.DOS,A$4000 

CALL-lSl 

6AOO<9600.BFFFM snatch a copy of DOS 3.3 

I 2 I Put original disk in drive 1 and initialized disk in drive 
2. 



9600<4000.69FFH 
S reset 
CALL-lSl 
9600<4000.69FFH 



piu SDS.DOS into control 

if computer hangs 

to reenter monitor 

again 



i 



$(unetimes it is safer to use an odd byte value to fill 



BLOAD binary file, A$xxxz, Dl use another address if necessary 

See note 
9600<6A00.93FFH ' DOS 3.3 back into control 

8 reset here we go again! 

CALL-lSl 
9600<6A00.93FTM 

zzzz<zzzz.yyyyM move any relocated files to proper place, if 

necessary - see note 
BSAVE binary fOe, A$zzzx, LSyyyy, D2 

Repeat step 2 for all other binary files. If a file must 
be saved above $4000, a reboot (step 1) will be necessary. 

Note: For any file loading to pages $04 to $7FF, or 
a Gle loading above $6A00, the file must be loaded 
somewhene between $800 and $6A00, so that normal DOS 
3.3 may be used to BSAVE die file. After DOS 3.3 has 
been relocated into control, the Gle can be moved back 
by a monitor move. For any file loaded (A$400, L$400) 
to the low res area, it is not necessary for a move back, 
as I have found out that a proper address, already present 
in the running Applesoft program, will ensure that it is 
BLOADed properly. One additioial Gle, RAMLOADER, 
does not have to be copied, as it is sinply a DOS relocation 
program and nev6r is called upon by any file, nor is it 
really needed. 

The binary files to BSAVE are: 

Magic SpeOs 

SPELLSPICS, A$800, L$1800 
PRINTER6+PICS+ERR, A$4400, L$1963 
MUSICRESETMOVE, A$300, L$48 
MEADOW, A$2000, L$2000 
KINGDOM OF SPELLS.LPIC, A$800, L$400 

Moptown 

HOME SWEET HOME.LPIC, A$1400, 400 
MOPTOWN PARADE.LPIC, A$1400, L$400 
PIC.MAPCRAM, A$4000, L$12F0 
PIC.HOTELCRAM, A$4000, L$1B48 
PIC.MOPTOWNCRAM, A$4000, L$17D8 
PRINTER12$800CRAM, A$4000, L$E68 
MUSICRESETMOVESHAPE, A$300, L$B0 
UNSCRAM.ERR, A$9240, L$3C0 

Reading and Writing Text Files 

As all text files (found only in Magic Spells) are 
sequential, rather than random, no complicated approach 
as in William Clarke's softkey is necessary. Each text file, 
when read, inputs as the first entry, the number of records. 
Thus, one can simply determine the record number and 
then input the following records as strings. Upon moving 
normal DOS 3.3 back into control, the records can be 
written to our initialized disk. In order to facilitate this 
operation, the following Applesoft program and 
accompanying binary move routine is the simplest 
approach. Just type both programs in and store them on 
your cracking disk where the SDS.DOS file is already 
found. 

Note thaj Ae Applesoft j)t;ogram wall first,_pLOAD 



the SDS.DOS file and a relocation routine, MVE. Then 
prompts are made to place original and copy disk (your 
initiallized disk) in the correct drives and the name of the 
text file is requested. Using the accompanying list of text 
files or names from the Magic SpeUs catalog, enter an 
appropriate file name. The program then will, using the 
MVE subroutine, place the correct SDS.DOS in place of 
DOS 3.3 (line 160) and read in the text file. Replacing 
DOS 3.3 (line 200) is followed by writing the file to drive 
2. The program then exits Gine 260). One can then type 
RUN and repeat the procedure for another text file. 

Text Exchanger 

10 REM TEXT. EXCHANGER 

20 TEXT : HOME : IF PEEK (810) <> THEN 90 

30 D$ = CHR$ (4) 

40VTAB4: PRINT "PLACE*CRACKER'DISK*IN"DRIVEM" 

50 PRINT "AND'PRESS'<RETURN>* :*" ; : GET Z$: PRINT 

60 PRINT D$; "BLOAD* MVE" : PRINT D$; "BLOAD* 

SDS.DOS,A$3000" 
70 POKE 810,1 
80 POKE 773,150: POKE 781,191: POKE 789,90: CALL 768: 

REM MOVE DOS 3.3 DOWN 
90 CLEAR 

100DIMFI$(30):O$ = CHR$(4) 
110TEXT:HOME 

120 VTAB4: PRINT "PLACE'MAGIC.SPELLS'IN^DRIVEM'AND" 
130 PRINT "D0S'3.3*C0PY*DISK'IN*DRIVE*2" 
140 PR I NT : PRINT "PRESS^RETURNiyHENDONE*:*" ; : GETZ$: 

PRINT 
150 TEXT : HOME : VTAB4: INPUT "FILE*NAME*:*" ;FF$ 
160 POKE 773 , 48,: POKE 781 , 89 : POKE 789 , 150 : CALL 768 : 

REM MOVE SDS.DOS UP 
170 PRINT : PRINT D$; "OPEN*" ;FF$;; ",D1" : PRINT D$; 

"READ*" ;FF$ 
180 INPUT NF: FOR I = 1T0NF: INPUT Fl$(l): NEXT 
190 PRINT D$; "CLOSE*" ;FF$ 
200 POKE 773, 90: POKE 781, 131: CALL 768: REM MOVE D0S3. 3 

UP 
210 PRINT : PRINTD$; "OPEN*" ;FF$; ",D2" : PRINTD$; 

"tHRITE*" ;FF$ 
220 PRINT NF: F0RI = 1T0NF 
230PRINTFI$(I):NEXTI 
240 PR I NT D$; "CLOSE*" FF$ 
250 TEXT : HOME 
260 PRINT "FINISHED" : END 

Checksums 



10 - $BADD 


100 - $E72B 


190- 


- $F495 


20 - $5EEC 


110 - $4CEF 


200- 


- $105A 


30 - $30D6 


120 - $BD0F 


210- 


- $2B7D 


40 - $D611 


130 - $958D 


220- 


- $4480 


50 - $73B6 


140 - $EE78 


230- 


- $312C 


60 - $2AC3 


150 - $2AE6 


240- 


- $DAFF 


70 - $90BB 


160 - $B995 


250- 


- $8694 


80 - $02EC 


170 - $A292 


260- 


- $B2E6 


90 - $9995 


180 - $C24E 








Hexdump of MVE 






0300: A9 00 85 3CA9 40 85 3D 




$116B 


0308:A9FF85 3EA9 69 85 3F 




$043C 


0310:A9 00 85 42A9B6 85 43 




$EDFF 


0318:20 4AFFA9 00 85 47 20 




$A522 


0320: 3FFF20 2CFF60 




$3651 



MVE Source code 



0300- 
0302- 
0304- 
0306- 
0308- 
030A- 
030C- 
030E- 
0310- 
0312- 
0314- 
0316- 
0318- 
031B- 
031D- 



A9 00 
85 3C 
A9 40 
85 3D 
A9FF 
85 3E 
A9 69 
85 3F 
A9 00 
85 42 
A9B6 
85 43 
20 4A FF 
A9 00 
85 47 



LDA #$00 
STA $3C 
LDA #$40 
STA $3D 
LDA #$FF 
STA $3E 
LDA #$69 
STA $3F 
LDA #$00 
STA $42 
LDA #$B6 
STA $43 
JSR $FF4A 
LDA #$00 
STA $47 



(tow byte origin) 

high byte origin 

bw end byte origin 

high end byte origin 

low byte destinatim 

high byte destination 

start the move 



36 



< Iteadera Data EXdhang* < 
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03 IF 
0322 
0325 



20 3F FF 
20 2C FF 
60 



JSR $FF3F 
JSR $FF2C 
RTS 



return to applesoft prog. 

Here are the text files to be transferred: 

Magic Spells 

LOG 

DEMONS I.MS 
DEMONS 2.MS 
DEMONS 3.MS 
DEMONS 4.MS 
DEMONS 5.MS 
DEMONS 6.MS 
DEMONS 7.MS 
DEMONS 8. MS 
DEMONS 9.MS 
DEMONS lO.MS 
DEMONS 11. MS 
SAMPLE.MS 
SAMPLE I.MS 
Q.MS 
C1982.MS 
01982.MS 
W1982.MS 

Last Step - Loosen the Reset Trap 

Now that all files, Applesoft, binary and text have 
been transferred, there is one small job to complete. I have 
never liked the commonly used reset trap in protected 
programs. Let's turn it off. Here's how: 

I 1 [ Boot normal DOS 3.3. Place either deprotected disk 
in drive 1. 

LOAD HELLO 
LISTIO 

I 2 [ Edit this line, removing the commands: POKE 
1010,23: POKE 1011,3: (keep everything else, though). 

I 4 I Save the changed program. 

UNLOCK HELLO if necessary 

SAVE HELLO 









L.A. Crackdown 

Lost Tomb 

Manhunter New York Ilgs 


EPYX 


MOST 




Datasoft 
Sierra On Line. 


Ik^/^NTIED 


Mavis Beacon Teaches Typing 
Modem MGR 


Software Toolworks 
MGR software 


Sof1:k 


eys 




National Inspirer Ton 
Observatory CHte) 


I Snyder Productions 








Mindscape 


Airheart 




Broderbund 


Operation Wolf 


Taito 


AJCOB 




Taito 


Piratesl 


Microprose 


Alien Mind 




FBI Software 


Platoon 


Data East 


Ancient Art of War at Sea 




Broderbund 


Pool of Radiance 


SSI 


Arkanoid 




Taito 


Ouadratic Equations II Olympus Educational Software 


Bad Street Brawler 




Mindscape 


Questron II 


Electronic Arts 


Beyond Zork 




Infocom 


Rastan 


Taito 


Bilestoad 




Datamost 


Renegade 


Taito 


Border Zone 




Infocom 


Rocket Ranger (Ilgs) 


Cinemaware 


Borg 




Sirius 


S.D.I.(IIgs) 


Cinemaware 


Bubble Bobble 




TaUo 


Sea Stalker 


Broderbund 


Bubble Ghost Ilgs 




Accolade 


Sky Shark 


Taito 


Bureaucracy 




Infocom 


Soko-Ban 


Spectrum Holobyte 


California Gaines (Ilgs) Epyx 
Chuck Yeager's Advanced Flight Simidator ? 
Cosmic Relief Datasoft 
Crime & Punishment Imagic 

Darklord Dntmenfi 


Sound Song A Vision 

Spare Change 

Speedy Spides 

StickyBear Math: Add & Subtract 


Advanced Software 

Broderbund 

Readers Digest 

? 


Design Your Own Train 
Dondra 




Abracadata 
Spectrum Holobyte 
counter SSI 


Strike Fleet 
Superstar Ice Hockey 


Electronic Arts 
Mindscape 


Dungeon Masters Assistant vol. LEa 


Superstar Indoor Sports 


Mindscape 


DROL 




Broderbund 


Teleport 


Cavalier 


Eliminator 


Adventure International 


Test Drive 


Accolade 


Explore-Australia 


Dataflow 


) Computer Service 


The Three Stooges (Ilgs) 


Cinemaware 


Frogger 




Main Street 


Thunder Chopper 


? 


The Games: Winter Edition 




Epyx 


Ticket to Washington D.C. 


Blue Uon Software 


Gladiator 




Taito 


Tomahawk 


Electronic Arts 


Gutenbery Sr. 




Micromation LTD. 


Tomahawk (Ilgs) 


Datasoft 


Halls of Montezuma 




Electronic Arts 


VCR Companion 


Broderbund 


Ice Demons 




Momingstar 


Wasteland 


,, Electronic Arts 


Impossible Mission n 




Epyx 


Wings of Fury 


\ Broderbund 


Indoor Sports 




Mindscape 


Wizardry:Retum of Werda 


Sir-Tech. 


Joker Poker 


. 


Mindscape 


Works (the) 


First Star Software 


King of Chicago 




Cineware 


ZorkOuest 


Infocom 



Ilgs APPLESOFT??? 

Now you can use Super Hi-Res and synthesizer 
sound & music from Applesoft BASIC. 
Yea . . . You really can! 
No new language to learn, 
Forget about the toolbox and its complexities. 

Put aside cumbersome and difficult P16 basics and 
acutally write something on your Apple Ilgs tiiat 
has all the color and sound your imagination can 
muster. Don't just dream about it, do it . . . quickly 
and easily! 

So What Software puts you in control and finally 
makes programming on the Apple Ilgs a reality! 

SONIX. ICONIX and DISC COMMANDER 

The Hands on Favorites. 

For Graphics: 

ICONIX (512K) $49.95 

For Sound: 

SONIX (IMEG) $59.95 

For "Hacking": 

DISC COMMANDER (S12K) . . . $39.95 

«Callu8tod«y.at;?;j)»«|;g^ 



VISA/MastaCard/American Express accepted 




SO WHAT V::^ SOFTWARE 

10221 Sl|l«r Av*. Suit* 103 FounUtn Valley ,C«S270B 



THE 



PHOTOLAB 

®la3S PHOEHIi: PHOTO I1I1I0TT£lTI0H3 



FOR USERS OF 



Newsroom" 



PRT-rrsHOP 



- Expand your graphics library 

T.M. 

• Convert PRINTSHOP graphics to photos 
and vice versa 

• Create negatives 

• Create mirror images 

• Create enlargements 

• Turn graphics upside down 

• Cut portions from existing graphics & 
combine to create new ones 

— Requires 128K (apple. Frankim, and LASER 
128 compatible) 

— Send $34.95 + 5.50 S&IH (Check or Money 

Order) Arizona state customers please add 6.5% sales tax 
TO: 

PHOENIX PHOTO INNOVATIONS 

P.O. BOX 51224 

PHOENIX, AZ 85076-1224 
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Mike Basford 



Softkey for. 



Reader Rabbit 

Learning Company 



Using PCTools or a similar program, change 
"HELLO.EXE". Search for CD 13 72 09 and change it to 
90 90 EB 24. What this does is bypass the disk check (CD 
13) and replaces the JB 2592 with JMP 25 AD. 



Irwin Roth 



In COMPUTIST #61, pg.44, a contributing author, 
Mike Basford, mentions a program called "CRACKER" 
which I have been unable to find. Please put me in contact 
with Mr. Basford or advise where or how I may attain 
this program. 

* Say Mike, could you handle this one for me? RDEXed 



Ann Onymous 



Sorry to be so confused. Am I supposed to be 
submitting this on an Apple or ffiM formatted textfile? 

* Until we get an IBM of our own, an Apple disk would 
be nice. We send the IBM formatted disks to a local reader 
who translates the files for us. RDEXed 

Softkey for... 



Print Shop 

Broderbund 



The Printshop program lets you install it on a hard 
disk, and will run thereafter without needing the floppy. 
The installation program, however, keeps track of its use, 
and will only allow four hard disk installations. 

Here's a way to trick it. 

Make a subdirectory on your hard disk. 

MD CAPS 

Run the installation program. 
PSHD 

Follow the prompts, and tell it to install Printshop in 
the CAPS subdirectory. The program will terminate and 
leave you at the A> prompt. 

Run the installation program again 

PSHD 

and select the "Remove from Hard Disk" option. The 
program will terminate by letting you know that it has 
increased your quota for hard disk installations. 

Now run PCTools or some similar program and 
UNDELETE all the files in the C;\PS subdirectory. With 
PCTools you should choose automatic undeletion. IBM 
filenames lose their first character when they are deleted. 
You will have to supply the lost letter of each filename 
- make them match the names on the floppy. 

Finally, use PCTools to undelete the hidden file 
C:\HPSDISK.SYS in the root directory of your hard disk. 

The whole process takes less than 10 minutes. You 
now have a working copy of Printshop on your hard disk, 
and have not "used up" one of the installations from your 
floppy. 



The A.S.P. 



Softkey for... 



XcDocopy Plus vl.09 



If you have a hard disk or want to create a backup 
copy that is not tied into the Xenocopy diskette, this patch 
will partially remove the copy protection. 

I 1 I Place the Xenocopy original disk in the 'A' drive. 

C:DEBUG XEN0C0PY.COM 

E 2EE BO 77 OC 02 90 90 

E 312 33 16 OE 03 81 F2 33 96 BO 77 30 C2 81 F2 E4 21 31 

CA 31 E2 31 FA 30 F2 30 D3 88 D8 88 E3 53 AA 42 E2 

D3CC 
G 

IHWhen DEBUG stops at CS:335, yo u next enter: 

I ^ : - ' ■ . . 



E 337 90 

E 339 90 90 

F 308 335 90 

F 3DE 3E6 90 This seems to negate copy protect checks 

E 308 B8 FC 78 BB 78 00 B9 00 00 BE 35 03 BF 35 03 

RAXO 

RBXO 

RCXO 

RDXO 

RCXA96 

N C:XENO.COM 

W CS:100 

Q 

'XENO.COM' may now be copied to XENOCOPY 
.COM or left on the hard disk. Repeat steps 1 and 2 for 
'XEN0WRJT.COM', substituting for 'XENOCOPY 
.COM' where necessary, also 'XENO.COM' needs to be 
a new name such as 'WRIT.COM'. 

Notes: 

1) The February version of ' 'Copy writ ' ' will make a good 
complete backup copy of die "Xenocopy Plus" disk. 

2) Version 1.16 of ' 'CopyUPC ' will make a backup copy 
but loses some of the copyprotection in the process. The 
above mods will allow for the lost copyprotection tracks. 

3) The main reason for tiiis work was that "Xenocopy" 
would not come up using a "Teac ' ' half-height drive, but 
will (seems to) afier the mods. 

4). These mods make all the code decrypted and available 
for inspection, so some sharp person can pursue the 
complete removal of the copy protection. 

(4a) Tbetwo " .EXE" files are the programs loaded from 

"XENOCOPY.COM" and "XENOWRIT.COM". They 
seem to be written as 512 byte sectors, with sector IDs 

' '119 to 126' ', so if they could be read and copied to 512 
byte "1 to 8" sectors and the "Xeno" programs modified 
to read the new format files, all the copyprotection would 
(just guessing) be removed. 

5). When you do the backup option, there is a hidden 
file "BACKUP.COM" that is used. 

6). As always, these unprotect procedures are tested as 
much as time will permit, an extensive test of modified 
versions are left up to the user. 

7). The public domain "Ultra" utilities help in analyzing 
the disks. 

Enjoy your new found freedom, hard disks forever! 



Softkey for.. 



Managing Your Money 

Andrew Tobias 



Those people who have Andrew Tobias' "Managing 
Your Money" (MYM) and a hard disk find it very 
inconvenient to put disk 1 in drive A to start up MYM. 
Below is an update to MYM version 1 .5, for people with 
Hard Disks, to bypass this problem. If you have only 
floppy disks drives, this procedure won't help much. 

n~l Make sure you run INSTALL and specify MYM is 
to be run using a Hard Disk. 

\T} Make a copy of MYM.EXE using the following DOS 
command making sure that MYM.EXE is on your Hard 
Disk. 

COPY MYM.EXE MYM.PGM N 

[T] Run DEBUG against MYM.PGM as follows with 
your input to DEBUG shown in bold. 

DEBUG 1IYM.PGM 
D 4709 470D 

XXXX:4709B8 0102CD13 
D 4744 4745 

XXXX:4744 75CF 
DEFDDEFDF 

XXXX: EFD0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 

00 
RCX 

CX EFD0 

• press return 

I 4 | If the above 4 displays do not show the same output, 
you are probability at a different level of MYM and will 



have to figure out a corresponding update using data from 
above and below. 



A 4709 

XXXX:4709 JMP EFDO 

XXXX:470C XOR AX.AX 

XXXX:470E 

A 4744 

XXXX:4744 NOP 

XXXX:4745 NOP 

XXXX:4746 

A EFDO 

XXXX:EFD0 PUSH BX 

XXXX:EFD1 MOV AX, 1453 

XXXX:EFD4 MOV [BX],AL 

XXXX:EFD6 INC BX 

XXXX:EFD7 DEC AH 

XXXX:EFD9 JNZ EFD4 

XXXX:EFDB POP BX 

XXXX:EFDC JMP 470C 

XXXX:EFDF 

RCX 



press return 



press return 



press return 



Writing EFED bytes 



CX EFD0 

:EFE0 

W 



RENAME MYM.EXE MYM.BAK 

RENAME MYM.PGM BiIYM.EXE 

MYM.BAK is now your unmodified, original MYM 
program. Save it, in case the new version does not work. 
You should no longer need to put disk 1 in drive A. 

Note: If you run the updated version of MYM.EXE 
from a floppy disk, you will be prompted to put Disk 1, 
2 or 3 in other drives. This new version must be installed 
using INSTALL specifying a Hard Disk and must executed 
from a Hard Disk to work. 



Richard Cole 



Softkey for. 



Managing Your Money vl.5 

Andrew Tobias 



These instructions will direct you how to change f 
Manage Your Money Version 1.5 so that it will rup.^n 
your hard disk without requiring a system disk in your 
floppy drive. Naturally these changes are meant to be used 
by licensed users only. 

This file represents several hours of stepping through 
compiled BASIC (yechhh a fate worse than death) in order 
to remove the offending code. If you find this usefiil please 
send $10.00 to: 
Richard Cole 
1071 Wilson Drive 
Simi Valley, CA 93065 

Run setup first to set up MYM for your system. Then 
run all three disks onto your hard disk. Then use Debug 
as instructed on MYM.EXE. From then on you can run 
MYM direcfly from your hard disk with no system disk. 

You can also use backup or copy to save MYM and 
its files to a floppy disk. This allows you to make extra 
backups etc. You must remember that you have to use 
SETUP.EXE on the original system disk to change the 
system setup as to number or drives, where to look for 
data files, screen type, etc. 

This was tested on DOS 3.0 using DEBUG 3.0. For 
earlier versions of DOS and DEBUG you might have to 
look up or down in memory one or two sectors to find 
the proper locations. 

Make sure to operate on a backup file and not the 
original. I suggest you set up MYM for your system first 
from the original disks and then run them on your hard 
disk. Then make a copy of MYM.EXE and use that to 
operate on. When you have it working copy it back to your 
hard disk and you're in business. 

At location $04F0 you will find CALL 44F2 or byte 
string E8 FF 3F. Change these three bytes to NOP NOP NOP or 
byte string 90 90 90. This removes the call to the floppy 
disk. 

At location $72DE you will find CALL 4848 or byte 
string E8 67 D5. Change these three bytes to NOP NOP NOP or 
byte string 90 90 90 . This removes those nasty little checks 
for the system disk. 
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the COMPUTIST shopper 



$45 D 



Software Package He Ilgs 

816 Paint $45 

Alternate Reality: The Dungeon $28 D 

AKemate Reality: The City $20 D 

Appleworks $190 D 

ArticFox $28n 

Bank Street Writer 64K $46 D 

Bank Street Writer Plus (128K) $46 D 

Bard's Tale $30 

Bard's Talell $35 

Bard's Tale III $35 D 

Califomla Games $26 O 

Certificate Maker $25 D 

Championship Karate $14 O 

Chessmaster 2000 $28 O 

Clip Art Library (for Palntworks Plus). 

Copy II Plus v8.0 $230 

Create with Garfield $20 

Create w/ Garfield Deluxe $28 O 

Crossword Magic $32 O 

Dark Lord $15 O 

Dazzle Draw $40 O 

DrawPlus $52 O 

M5 Strike Eagle $240 

Fantavision $34 O 

Right Simulator II $36 O 

Force 7 $15 D 

Halls of Montezuma $28 O 

Hardball $22 D 

Hitchhiker's Guide $20 

Jet $29D 

Karateka $24 O 

King's Quest $32 O $32 O 



$35 D 
$26 D 



$20 
$23 D 



$40 



$28 O 
$28 O 



Software Package He Ilgs 

King's Quest II $32 D $32 D 

King's Quest III $32 $32 O 

King's Quest IV $32 O 

Knight of Diamonds $23 O 

Legacy of the Ancients $28 O 

Leisure Suit Larry $26 O $26 O 

Lode Runner $24 O 

Macroworks $20 O 

MathBlaster $28 O 

Math Blaster Plus $29 O $29 O 

Math Rabbit $270 

Math Talk $35 O 

Marble Madness $25 O $25 O 

Mean 18, Ultimate Golf $28 O 

Merlin 8/16 $80 

Millionaire II $40 

Mousewrite $99 O $99 O 

Multiscribe 3.0 $48 O $66 O 

Music Studio 2.0 $52 O 

Newsroom $38 O 

Paint Write Draw $120 

Palntworks Plus $47 O 

Palntworks GoM $65 O 

Pegasus $23 O 

ThePrintShop $340 $40 

Print Shop Companion $27 O 

Print Shop Graphics Library: 

Disk One $16 O 

Disk Two $160 

Disk Three $16 O 

Pro-Byter $32 O 

Reader Rabbit $270 $34 O 



Software Package 



He Ilgs Software Package 



He Ilgs 



Silent Service 

Space Quest 

Space Quest II 

Star Reet 

Star Trek- The Kobayashi Alternative. 
Star Trek II- The Promethean 

Prophecy 

Stickybear Series: 

ABC's 

Math I 

Math II 

Numbers 



Shapes . 
Typing. 



Thexder 

TtmeOut Superfonts 

Tomahawk 

Topdraw 

Type 

Typing Tutor IV 

Ultima V 

Visualizer 

Where in USA Is Carmen San Diego. . 
Where in WorM is Carmen San Diego. 
Where in Europe is Carmen San Diego 

Wings of Fury 

Winter Games 

Wizanly 

Word Attack 

WordPerfect w/ Spelling Checker-, . . . 



$23 O 
$32 D 
$32 O 
$35 O 
$27 D 

$27 O 

$24 D 
$24 
$24 O 
$24 O 
$24 O 
$24 O 
$24 O 
$24 O 
$23 O 
$42 D 
$23 O 
$660 
$30 
$32 
$400 
$53 O 
$300 
$300 
$300 
$25 O 
$25 O 
$32 O 
$28 O 
$950 



$32 O 



World Games 

Writer's Choice Elite 

Writer Rabbit 

Yeager's Advanced Right Trainer. 



$25 O 
$60 
$24 D 
$28 O 



$27 O 



$23 O 



$32 O 
$59 O 



$27 O 



$95 O 



Name. 



JD#. 



Address. 



City. 



. State . 



Zip. 



Country. 



Phone . 



Exp. 



Softkey PubGsUiig FO Box 110816-1 Tacomii WA 98411 
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• Software 
SUBTOTAL 

• Plus 
SHIPPING 
(see rigtit) 

• WA residents 
Sales Tax 
7.8% 



■ TOTAL 
Enclosed 



How To Order 



• US orders: Check the box for your 
selection. For Apple Ilgs software, check 
the box in the Tight-haind column. 

• Please add $3 per order for shipping 
& handling. Orders over $200 receive 
free shipping. 

• Most orders shipped UPS, so use your 
street address. 

• Washington state residents, please 
add 7.8% sales tax. 

e Foreign Orders: Please inquire as to 
appropriate shipping fees. 



* Prices subject to change without notice. 

77>e COMPUTIST Shopper is offered as a 
service to our readers. Bepause we do not 
'stocl(' tiut order only the Software rteeded, 
we are able to toep operadrtg costs to a 
minimum and can pass the savings on to 
you. 

in most cases, your order is shipped 
within two weelfs. The COMPUTIST 
Shopper will NOT cash your check nor 
charge your credit card until your software 
is ready to te shipped. If the software you 
ordered is not available, you will have Vie 
option to cancel your order, or make an 
alternate selection. 



How to place an Unclassified Ad 



If possible, send text on 5.25" Apple 
formated disk, include a typed sample copy 
with appropriate instructions. Use up to 40 
characters per Une, we will adjust word 
wrap. The Computist club member charge 
is $4 (for processing) plus 50 cents per line. 
For non-members, the charge is $4 plus $1 
per line. Multiple insertions of the same ad 
are charged only for the line rate, unless 
changes are made to the copy. 

Special Graphics Instructions: The first 
three words of the first line are printed in 
bold for free. If you want other words 
bolded, use 5 cheiracters less per Une. Use 
10 cheiracters less per line if you have a lot 
of uppercase letters. Bold letters are wider 
than normcil. Circle the words you want 
bolded. If you want a line centered, vwite 
CENTER next to that line. There is no charge 
for centering any line. 

You must check your ad, for errors, the 
first time it runs. Enors on our part will be 
corrected, then, for free. Errors or changes 
on your part will be charged the $4 
processing fee. 

Our liability for errors or omissions is 
limited to the cost of the ad. 

We reserve the right to refuse any ad. 

Washington state residents add 7.8% 
sales tax. 

Send this form and a check or money 
order (funds drawn on US bank only) for the 
entire amount to: 

COMPUTIST unCLASSBFIEDS 

POBoxll084<> 

Tacoma, WA 98411 



Trade your unwanted software. Send 
your list of programs to trade. I have over 
70 originals to trade. 

Byron Blystone 

P.O. Box 1313 
Snohomish, WA 98290 

Introducii^ Robot Arena 

A multi-level game for your apple. Pits 
you against the ultimate adversary, who 
follows your every move. Shoot your way 
through endless waves of robots - avoiding 
obstacles and saving your human friends. 
Provides hours of white-knuckle fun. 
Comes on a copyable SW" disk. Send 
$15.00 -I- $2.5© for shipping & handling. 
Ohio residents add $1.05 for sales tax. 

WR Enterprises 

3339 Kingsgate 

Toledo, OH 43606 

Original Apple Software 

New and used. Trade/sell. Over lOO 
games and adventures. Also GS software, 
hardware, and misc. Send stamp for list. 
Steve Wadsten, 20318 Fremont, Livonia, 
MI 48152 

Max's Tax 

Appleworks Tax Preperation program. 
Simple to use! Form 1040, schedules A, 
B, and D. Form 2210, 6251, 8598 and 
worksheet for taxable social security or 
railroad retirement benefits. Send $15 to: 
Max's Tax, PO Box 672065, Chugiak, 
AK, 99567-2065 



Software, Books, Magazines Buy & Sell 
- "Originals Only" Frank Polosky, 
PO Box 9542. Pittsburgh, PA, 15223 

ZIA Disk Drives Center 

5.25 Daisy Chainable Drives. Works just 

like the Apple brand, only has 

enhancements, such as speed adjust, wirte 

enable/disable switch, 1/2 height, formats 

40 tracks. Boots great on the GS, He, 

Laser and Ue. $140 each. 

Silicon Shack 

3900 Eubank NE, Suite 9 

Albuquerque, NM 87111 

505-293-4077 voice line • 

505-293-5538 BBS system 

** ATTENTION GS USERS ** 
PROBE/GS - The Professional Block 
Editor designed exclusively for the Apple 
ngs, is available now! Features read-write- 
edit of any block on your 3 ¥i " disks. Scans 
an entire disk for ASCII or hex sequence 
in under 90 sees! Includes 65816 
disassembler and Imagewriter n support. 
$12.95 -1-2.00 P«&H, CHK or M/O to: 
KPW Software, 529 St Clair Ave, 
Jackson, MI 49202. 

COMPUTIST back issues original print 
dealer storage available. #13, #14, #15, 
#21, #23. Each $10 w/shipping. Or 
exchange for your #2, 4, 5, 7. Cash or 
U.S. personal check acceptable. Shunichi 
Mikamo, 2-2-2-214 Shimoochiai, 
Shinjuku, Tokyo 161, JAPAN 
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TRAC CARD 




Boot Process Memory Card 

+On-Board Memory Stores Up To 200 Disks Of Accessed Tracks While Powerd Up 
+AII Disks Are Automatically Monitored From The Moment You Power Up. The 

Tracks Are Divided Into Groups Of "Booted" Disks 
+Save Time When Using Backup Software- The Tracks Accessed May Be Displayed 

In Numerical Order Or In The Order In Which They Are Read 
+TRAC CARD Gives You Maximum Accuracy For Backing Up Software By Precisely 

Storing 1/4, 1/2 and 3/4 Tracks, As Well As Full Tracks 
+You May Choose 40 or 80 Column On Monitor Or Dump Data To Printer. Name 

Each Disk When Printing Track List 
-fChoose Either Decimal Or Hexidecimal Readout 
■fUse In Any Slot, Including Slot #3 On lie 
+Works With Any Apple Compatible 5 1/4" Drive 
+Works With Apple II, 11+ and lie. As Well As Compatibles 



Price $159.95 Plus $3.00 Shipping & Handling 



Personal checks, M.O,, 
Visa and Mastercard 

Phone 913 676-7242 



IRAK STAR 




Constant Dfgital Readout of Disk 
Drive Head Position 

+Works With Any 5 1/4" Apple Compatible Drive 

+Saves Copying Time With Nibble Programs 

+Copy Only Tracks That Are Displayed 

+lf Copied Program Doesn't Run, TRAK STAR Displays Track To Be Recopied 

■fDisplays Full and Half Tracks 

+Operates With Any Apple Compatible Program, Including Protected Software 

■(■Displays Up To 99 Tracks and Half Tracks; Compatible With High Density Drives 

■•■Does Not Use A Slot in the Apple 

■fFor Apple II, !!■+ and //e 

■fSimple One Minute Installation 

Price $99.95 Plus $3.00 Shipping & Handling 
Adaptor Cable Required For 2 Drive System $1 2.00 
DuoDdisK 5 1/4" Unidisk and lie Owners Please Write 



Apple is a registered trademark of Apple Computer Inc 

Midwest 



MN\ 



Microsystems 



10308 Metcalf, Suite 355 
Overland Park, KS. 66212 



FIND IT FAST! MAKE IT EASY! 



looking for a QUICK AND EASY way to find your favorite SOFTKEY, ARTICLE, or PUBT TIP without having to reread your entire Computist library? Want to SAVE 
precious TWE as well as effort? W9ll...he« is your solution: The COIIPOTWT SWER INDEX! With the (X)MP^^ 

ARnCLES, PUY TIPS md APTS (and MUCH MORE) to your favorite programs l)y program name, distributor, or any of ten search criteria. At a glance, you have 
the issue, page, special requirements, iMigs, and (only in THIS DATA BASE), "TYPP of softkey. 



The COMPUTIST SUPER INDEX DAM BASE INCLUDES EVERYTHINQ. IF IT IS PRINTED IN COMPUTIST, IT IS USTED IN THE COMPUTIST SUPER 
INDEX! As of the May 1989 issue (#66), the Computist Super Index twasts THREE INDEXES and TWELVE SUPPORT HLES with OVER 3900 KCOiffiS AND 
21,000 ENTRIES! EACH MONTH the Computist Super Index data beee gains an average of over 100 records and 500 entries! 

^ FEATURES ^ ■ 



i^ The Computist Super Index USTS EVERY ITEM PUBLISHED IN COMPUTIST, from HARDCORE Vblume 1, Numlwr 1, to the present! 

i^ ALL RDEX INPUTS ARE INCLUDED and categorized! Some of the categories: Article, Program, Editorial, Help Wanted, Comparison. 

■iV OVER TEN nELOS to search and sort from: TITLE, ISSUE #, RMSE, DISTRIBUTOR, INPUT LOCATION, DESCRIPTION, SOFTKEY TYPE, and MORE! 

^ SOFTKEY TYPE IDENTIFES THE EXAa DE-PROTECTION TECHNIQUES USED FOR EACH ENTRY! 

^ FORMAIi APPLEWORKS (ProDOS only), DIF or ASCII TEXT (IX)S 33 or ProDOS). PLEASE SPECIFY "DOS" or *ProDOS" on order form (twiow) 

1V NOWAWUUBLEONaS" DISKETTESI 



PRICES: 

Computist Super INDEX (US') 
Computist Super INDEX (U') 
EACH (monthly) UPDATE (S^") 
EACH (monthly) UPDATE (&5') 



U4. 


FOREKSN 


$8.95 


$10.60 


S9.60 


$11.25 


$4.95 


$6.60 


$5.60 


$7.25 



ORDER FORM ■• 

INDEX or UPDATE APPLEWORKS or 



SELECIi INDEX or 

What COMPUTER are you using? 

What DATA BASE are you using? 

What WORD PROCESSOR are you using? 



EACH UPDATE CONSISTS of the ENTIRE DATA BASE and TOTALLY REPLACES ALL 
PREVIOUS VERSIONS! Data Base is updated each issue. UPDATES ARE AVAILABLE at 
any time. PRICE INCLUDES SHiPPiNG. ALL ORDERS shipped air mail. MINIMUM RAM 
REQUIRED: 48K for DIF or ASCII TEXT (omnt, ami 128K for Apptewnrks. 
ECONOMICAL UPDATE SUBSCRIPTKNIS AVAILABLE! 

ORDER FORM 

ASai or DIF Sb25'' or 3L5' PRODOS or DOSU 

WHAT is your RAM SIZE? 



HOWTOOROER: (1) CUT OUT OR COPY ORDER FORM (2) CHICLE DESIRED OPTMNS (31 COMPUTE OUESTMNS 

(4| SEND WITH CHECK OR MONEY ORDER TO; OAVN) R. HOPKINS 3495 WL HOVE PLACE DENVER, CO 80219 



UK 



couppranr #»g | 



